Alerts as a Notification Source Type
Alerts are one example of a notification source type, a component of the Coralogix infrastructure capable of sending notifications.
Supported alert subtypes
A notification source subtype adds an added layer of granularity to a notification source type. For alerts, a source subtype consists of three elements: an alert type, a condition, and status.
The following alert source subtypes are supported:
| Source | Type | Condition | Status | Description |
|---|---|---|---|---|
| Logs | LOGS_IMMEDIATE | — | Triggered / Resolved | Alert immediately when a log of interest is detected. Docs |
| Logs | LOGS_THRESHOLD | More than / Less than | Triggered / Resolved | Alert when the sum of logs crosses a predefined threshold. Docs |
| Logs | LOGS_RATIO_THRESHOLD | More than / Less than | Triggered / Resolved | Alert when the ratio between two log queries reaches a set threshold. Docs |
| Logs | LOGS_TIME_RELATIVE_THRESHOLD | More than / Less than | Triggered / Resolved | Alerts when a fixed ratio reaches a set threshold compared to a past time frame. Docs |
| Logs | LOGS_ANOMALY | More than usual | Triggered / Resolved | Alert when a log crosses an AI-generated baseline. Docs |
| Logs | LOGS_NEW_VALUE | — | Triggered | Alert on a newly detected value in a time series. Docs |
| Logs | LOGS_UNIQUE_COUNT | More than | Triggered | Alert based on a unique value count per key. Docs |
| Metrics | METRIC_THRESHOLD | More than / Less than / More than or equals / Less than or equals | Triggered / Resolved | Alert when a metric crosses a predefined threshold. Docs |
| Metrics | METRIC_ANOMALY | More than usual / Less than usual/ | Triggered /Resolved | Alert when a metric crosses an AI-generated baseline. Docs |
| Tracing | TRACING_IMMEDIATE | — | Triggered | Alert immediately when span duration exceeds a set latency. Docs |
| Tracing | TRACING_THRESHOLD | More than | Triggered | Alert when trace latency crosses a predefined threshold. Docs |
| Flow | FLOW | — | Triggered / Resolved | Alert when any combination of alerts occur in a specific sequence within a defined timeframe. Docs |
All supported alert notification source subtypes, consisting of EntityType and EntitySubType, can be found in the Alerts API.
Alerts Notification Source Type Schema
General reference
Link to the incident page (e.g., https://coralogix.com/#/insights?id=76c411be-gg4d-4fb1-a987-5fce042deaaf).
Used as the deduplication key.
Unique identifier of the alert. Use it to create an alert URL in your notification; e.g., "alert_url": "https://teamname-prod.app.eu2.coralogix.com/#/alerts/{{alert.id}}"
Priority level of the alert group (e.g., "P1").
Current status of the alert (e.g., "Triggered").
The timestamp indicating when the alert was triggered.
The version ID associated with the alert definition.
The timestamp when the alert definition was created.
A textual description of the alert definition.
Labels associated with the alert definition (e.g., host, region).
List of keys by which the alert is grouped (e.g., host, region).
The unique identifier of the alert definition.
Notification setting for the alert definition (e.g., "Triggered").
Name of the alert definition (e.g., "CPU Usage Alert").
Priority level of the alert definition (e.g., P1).
Time in minutes after which the alert can be retriggered.
Current status of the alert definition.
Type of the alert (e.g., "metricThreshold").
The timestamp when the alert definition was last updated.
Context reference
All templates have access to the _context variable, which contains metadata about the notification source type, including system identifiers and trigger details. This context allows you to dynamically customize your template content based on the notification's origin.
Find out more here
Define a Destination 
Light
light
dark
User Guides
DataPrime
Integrations
OpenTelemetry
Developer Portal