Alerts

# Basic: alert if more than 50 errors in 30 minutes
severity:error | count | over:30m > 50

# Any fatal errors in 5 minutes
severity:fatal | count | over:5m > 0

# Pattern match: payment failures
message:~"payment failed" | count | over:1h > 10

# Service-specific errors
severity:error service:billing | count | over:15m > 20

# Dead service (no events)
from:events | count | over:10m < 1

# 5xx errors
status_code:>=500 | count | over:5m > 50

# Latency degradation
| avg(duration_ms) | over:10m > 2000

# Signup drops below threshold
from:events event_name:signup | count | over:1h < 5

# Database timeout detection
message:~"database timeout" | count | over:5m > 0

| count | over:30m > 50           # count of matching rows
| avg(duration_ms) | over:10m > 2000   # average of a field
| sum(amount) | over:1h > 10000        # sum of a field
| max(response_time) | over:5m > 5000  # max value

"alert me if there are more than 100 errors in 30 minutes"
→ severity:error | count | over:30m > 100

"notify when fatal errors happen"
→ severity:fatal | count | over:5m > 0

"alert if payment failures exceed 10 per hour"
→ message:~"payment failed" | count | over:1h > 10

"warn if average response time goes above 2 seconds"
→ | avg(duration_ms) | over:10m > 2000

"alert when no events for 10 minutes"
→ from:events | count | over:10m < 1

"alert if 5xx errors exceed 50 in 5 minutes"
→ status_code:>=500 | count | over:5m > 50

{
  "alert": "Error Spike",
  "metric": "error_count",
  "value": 127,
  "threshold": 50,
  "status": "triggered",
  "severity": "critical",
  "project_id": "uuid",
  "message": "Error Spike: error_count is 127 (threshold: 50)",
  "timestamp": "2026-05-26T14:32:00Z"
}

🔴 *Alert TRIGGERED*: Error Spike

Error Spike: error_count is 127 (threshold: 50)

*Metric:* `error_count` | *Value:* `127` | *Threshold:* `50`

x-goodlogs-signature: sha256=a1b2c3d4e5f6...

const crypto = require('crypto');

function verifySignature(body, secret, signature) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature)
  );
}

// In your webhook handler:
app.post('/webhook', (req, res) => {
  const sig = req.headers['x-goodlogs-signature'];
  if (!verifySignature(JSON.stringify(req.body), WEBHOOK_SECRET, sig)) {
    return res.status(401).send('Invalid signature');
  }
  // Process alert...
});

import hmac, hashlib

def verify_signature(body: bytes, secret: str, signature: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)

# In your webhook handler:
sig = request.headers.get('x-goodlogs-signature', '')
if not verify_signature(request.data, WEBHOOK_SECRET, sig):
    abort(401)

Cooldown: 15 minutes
→ After triggering, the alert won't fire again for 15 minutes
   even if the metric stays above the threshold.

POST /api/orgs/:org/projects/:project/alerts/:id/mute
{ "minutes": 60 }

🚨 {{name}}: {{metric}} is {{value}} (threshold: {{threshold}}, status: {{status}})

# All alert rules
from:alerts

# Currently firing alerts
from:alerts status:triggered

# Critical alerts
from:alerts severity:critical

# Count alerts by status
from:alerts | count by status

# Recent triggers
from:alert_events event_type:triggered | last:7d

# Most triggered alerts
from:alert_events event_type:triggered | count by alert_name | top 10 | last:30d

# Alert frequency trend
from:alert_events | count | timeseries 1d | last:30d

# Average resolution time
from:alert_events event_type:resolved | avg(duration_seconds) | last:30d