LogPulse alerting monitors your log data in real time and notifies you when conditions are met. LogPulse provides two complementary alerting systems: query-based alerts (threshold counting, pattern matching, and log absence detection) and AI-powered anomaly detection that automatically learns service baselines and detects deviations using statistical analysis.

Each alert rule defines a condition, an evaluation schedule, one or more notification channels, and an optional escalation policy. When a condition is met, LogPulse creates an alert event and dispatches notifications through the configured channels.

To create an alert rule, navigate to Anomaly Detection in the left sidebar and click Create Rule. The rule builder walks you through the following steps:

1. Name and description: Give the rule a descriptive name and optional description. These appear in notifications, so make them actionable.

2. LPQL condition: Enter the query that defines what to monitor. The query runs on a schedule and its results are evaluated against the condition.

3. Condition type: Select from Threshold, Pattern Match, or Absence. Configure the specific parameters for the selected type. For AI-powered anomaly detection, use the Anomaly Detection section in the sidebar instead.

4. Evaluation schedule: Set how often the query runs (evaluation interval) and the time window for each evaluation. The interval should be shorter than or equal to the window.

5. Severity: Choose from Critical, Warning, or Info. This determines the urgency of notifications and the escalation behavior.

6. Notification channels: Select one or more channels to receive alerts. You can assign different channels per severity level.

7. Click Save Rule to activate the alert.

Name: High Error Rate - API Gateway
LPQL: source=api-gateway level=error | stats count as error_count
Condition: error_count > 50
Window: 5 minutes
Interval: 1 minute
Severity: Warning
Channels: #ops-alerts (Slack), [email protected] (Email)

LogPulse supports four notification channel types. Each channel can be used by multiple alert rules, and each rule can send to multiple channels.

{
  "alert_name": "{{rule.name}}",
  "severity": "{{alert.severity}}",
  "triggered_at": "{{alert.triggered_at}}",
  "condition": "{{rule.condition}}",
  "matching_count": {{alert.matching_count}},
  "dashboard_url": "{{alert.dashboard_url}}",
  "logs_sample": {{alert.logs_sample_json}}
}

The following table lists all configuration parameters for each notification channel.

Escalation policies define a sequence of notification actions that execute if an alert is not acknowledged within a specified time. Each level in the escalation chain specifies a delay and one or more channels.

Policy: Critical Service Alert
  Level 1 (immediate):
    - Channel: #ops-alerts (Slack)
    - Channel: [email protected] (Email)

  Level 2 (after 15 minutes unacknowledged):
    - Channel: #ops-critical (Slack, mention @oncall-group)
    - Channel: PagerDuty (High urgency)

  Level 3 (after 30 minutes unacknowledged):
    - Channel: [email protected] (Email)
    - Channel: PagerDuty (Critical, escalation to management policy)

Escalation stops as soon as the alert is acknowledged at any level. If the alert is resolved automatically (the condition clears), all pending escalations are cancelled and a resolution notification is sent to all channels that received the original alert.

Each alert event moves through a defined set of states. Understanding these states helps you manage alerts effectively and configure appropriate automation.

Alerts can be acknowledged via the LogPulse dashboard, Slack action buttons, PagerDuty, or the API. The acknowledgment includes the user identity and timestamp for audit purposes.

Auto-resolve is enabled by default for threshold alerts. When the condition clears (the metric returns below the threshold), the alert is automatically resolved and a resolution notification is sent. Anomalies are auto-resolved when metrics return to normal ranges. Pattern match and absence alerts must be resolved manually or via the API. You can also provide feedback on anomalies (true positive or false positive) to help improve detection accuracy.

The Alert History page shows all past alert events with their state transitions, notification delivery status, and acknowledgment details. Use it to review incident timelines and measure response performance.

Alert analytics are available on the Anomaly Detection overview page. Use the time range picker to analyze alert trends over days, weeks, or months. The analytics dashboard includes charts for alert volume by severity, MTTA/MTTR trends, top firing rules, and channel delivery performance.

Follow these guidelines to build an effective and sustainable alerting strategy:

Do not alert on everything. Focus on conditions that require human intervention. If an alert does not require someone to take action, it should be a dashboard metric or a logged event, not an alert.

Use severity levels consistently. Reserve Critical for issues that impact customers or revenue. Use Warning for degraded performance or approaching thresholds. Use Info for awareness items that do not require immediate action.

Test your notification channels. After configuring a new channel, send a test notification to verify delivery. Test regularly to catch expired webhooks, rotated credentials, or changed channel configurations.

Review alerts regularly. Schedule a monthly review of all alert rules. Disable or tune rules with high false positive rates. Remove rules for decommissioned services. Adjust thresholds based on current traffic patterns.

Use escalation policies for critical alerts. Ensure that critical alerts always have a path to a human who can act, even outside business hours.

Alert rules, channels, and mute windows can be managed programmatically via the LogPulse API. All endpoints require an API key with full access scope.

curl -X POST https://api.logpulse.io/api/v1/detect/services \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $LOGPULSE_API_KEY" \
  -d '{
    "service": "api-gateway",
    "displayName": "API Gateway",
    "metrics": ["error_count", "error_rate"],
    "sensitivity": "medium",
    "detectionInterval": "2m",
    "detectionLookback": "5m",
    "urgentDetectionEnabled": true,
    "urgentErrorRateThreshold": 50,
    "urgentMinBatchSize": 20
  }'

curl -X POST https://api.logpulse.io/api/v1/detect/response-channels \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $LOGPULSE_API_KEY" \
  -d '{
    "name": "Ops Slack Channel",
    "type": "slack",
    "config": {
      "webhookUrl": "https://hooks.slack.com/services/T.../B.../xxx"
    },
    "minSeverity": "high",
    "enabled": true
  }'