Skip to main content
POST
Create an alert

Authorizations

Authorization
string
header
required

A workspace API key, created in Superlog under Settings → API keys.

Body

application/json
aggregation
enum<string>
required

count counts matching logs or spans; other aggregations read field. Metrics use sum or avg.

Available options:
count,
count_distinct,
sum,
avg,
min,
max,
p50,
p90,
p95,
p99
comparator
enum<string>
required

gt fires when the value is above threshold, lt when it is below.

Available options:
gt,
lt
source
enum<string>
required

logs, traces (spans), or metric.

Available options:
logs,
traces,
metric
threshold
number
required
name
string
required
Required string length: 1 - 200
field
string | null

What a log or span aggregation other than count reads: duration, an attribute key, or an AI usage field such as ai:cost.

Maximum string length: 200
filter
object

Narrows the data the alert reads. resourceAttrs keys may start with resource., span., log., or field.; a bare key is a resource attribute. service, severity, spanName, statusCode, and minDurationMs match those fields of a log or span.

groupBy
string | null

The attribute key to split by when groupMode is per_group, such as service.name.

Maximum string length: 200
groupMode
enum<string>

single checks one total. per_group checks each groupBy value and fires for each one separately. Defaults to single.

Available options:
single,
per_group
metricName
string | null

The metric to read when source is metric.

Maximum string length: 200
windowMinutes
integer

How many minutes of data each check reads. Defaults to 5.

Required range: 1 <= x <= 1440
enabled
boolean

A disabled alert is not checked. Defaults to true.

evaluationIntervalSeconds
integer

How often the alert is checked. Defaults to 60.

Required range: 60 <= x <= 3600
slack
object | null

Where firing and recovery messages are posted. Without a channel the alert only records its activations.

Response

Created

alert
object
required