You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: en/monitors/alert-rules/elasticsearch.mdx
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,11 @@ Due to SQL feature dependency, only **ElasticSearch 6.3** and above versions are
14
14
| Config Item | Description |
15
15
|--------|------|
16
16
|**Query Language**| Currently only supports SQL syntax |
17
-
|**Field Processing**| All field names are automatically converted to lowercase; please use lowercase letters when configuring |
17
+
|**Field Processing**| Preserves the column-name casing returned by Elasticsearch SQL. Use the actual returned column names when configuring label and value fields |
18
+
19
+
<Tip>
20
+
Use explicit, stable column aliases in SQL and match their casing exactly in field mappings. This prevents mappings from breaking when query fields change.
Table-shaped queries for MySQL, PostgreSQL, Oracle, ClickHouse, Elasticsearch, and SLS, as well as **raw log** queries for Lokiand VictoriaLogs, return rows with multiple fields. Use **Value fields** and **Label fields** to assign each field a purpose. Any remaining fields are automatically carried with the alert as additional information.
7
+
Table-shaped queries for MySQL, PostgreSQL, Oracle, ClickHouse, Elasticsearch, SLS, and Tencent CLS, as well as **raw log** queries for Loki, VictoriaLogs, SLS, and Tencent CLS, return rows with multiple fields. Use **Value fields** and **Label fields** to assign each field a purpose. Any remaining fields are automatically carried with the alert as additional information.
8
8
9
9
<Warning>
10
10
The complete field-mapping behavior described on this page requires monit-edge `v0.53.0` or later, especially the `$<query name>.<field name>` convention for query-provided additional information. Upgrade the alert engine to `v0.53.0` or later before using these settings.
@@ -69,6 +69,8 @@ Explicitly select label fields for raw log queries. Otherwise, timestamps and ra
69
69
70
70
The SLS-provided `__source__` and `__time__` fields do not automatically become labels when Label fields is empty. If you need either value, assign it an alias in the query and configure the alias as a regular field.
71
71
72
+
Tencent CLS raw logs can also contain `__cls_*` metadata fields. Monitors does not exclude these fields automatically. Explicitly select stable fields such as service, host, or Topic as labels, and leave log bodies, timestamps, and request-level identifiers as additional information.
73
+
72
74
## Referencing values in threshold expressions
73
75
74
76
The query name is the prefix of its threshold variables. For example, suppose query A has a value field named `error_count`.
@@ -140,12 +142,21 @@ The `$` prefix identifies query-provided fields. A custom field configured on th
140
142
A No data alert carries the additional information from the last successful result for that alert object. If the query has never returned data, no query-provided additional information is available.
141
143
</Note>
142
144
143
-
## Query result row limit
145
+
## Query result row limits
146
+
147
+
Edge limits scheduled alert queries and interactive preview queries separately. The following defaults can be configured independently by the deployer:
|**Scheduled alert queries**| 1,000,000 rows |`--alerter.alertQueryMaxRows`| Main, recovery, and related queries |
152
+
|**Data preview queries**| 1,000 rows |`--alerter.previewMaxRows`| Data source queries and rule editor previews |
153
+
154
+
A data source can impose a stricter limit. For example, raw log queries for SLS, Tencent CLS, Loki, and VictoriaLogs allow at most 100 configured rows. The effective limit is the lower of the scenario limit and the data-source-specific limit.
144
155
145
-
All alert rule queries have a hard limit of **1000 rows**, including the evaluation queries for Threshold, Data exists, and No data, as well as recovery queries and related queries. When a query returns more than 1000 rows, the query fails outright (error `too many rows`), this evaluation reports an error, and no alert is produced.
156
+
When a query exceeds its effective limit, it fails with `too many rows`. Monitors does not return a partial result or evaluate alerts with truncated data.
146
157
147
158
<Warning>
148
-
The limit applies to every data source type (MySQL, PostgreSQL, Oracle, ClickHouse, Elasticsearch, SLS, Loki, VictoriaLogs, Prometheus, etc.). High-cardinality Prometheus queries (more than 1000 series) or SQL queries returning large result sets will start failing and stop producing alerts.
159
+
Increasing the Edge row limit does not disable safeguards for response bytes, field size, or total result values. High-cardinality Prometheus queries and large SQL results can still fail on another resource limit.
149
160
</Warning>
150
161
151
162
Aggregate in the data source instead of letting a single rule query return many rows:
@@ -160,7 +171,7 @@ Each query result row can become one alert instance. Aggregating in the data sou
160
171
161
172
This page applies to:
162
173
163
-
- MySQL, PostgreSQL, Oracle, ClickHouse, Elasticsearch, and SLS queries
164
-
-**Raw log** primary queries for Lokiand VictoriaLogs
|`tencent_cls.limit`| Maximum number of returned rows, raw mode only, 1-100 |`1`for new rules |
28
+
|`tencent_cls.limit`| Maximum number of returned rows, raw mode only, 1-100 |`1`|
29
29
30
30
The region dropdown offers a list of commonly used regions (e.g., ap-guangzhou, ap-shanghai, ap-beijing); it is a suggestion, not a whitelist. You can also type any region code matching `[a-z0-9-]`; Tencent Cloud decides whether it works.
31
31
@@ -36,7 +36,7 @@ The region dropdown offers a list of commonly used regions (e.g., ap-guangzhou,
36
36
Searches logs with CQL or Lucene syntax and returns matching log lines. Each returned line can produce one alert.
37
37
38
38
- The time window is capped at **6 hours**.
39
-
-`tencent_cls.limit` controls the maximum number of log lines returned by a single query. New rules return only the latest line in the time window by default; you can set 1-100. Leaving it empty means this rule has never had the setting, so Edge falls back to its old default of 100 lines.
39
+
-`tencent_cls.limit` controls the maximum number of log lines returned by a single query; you can set 1-100. New rules store `1` by default, and Edge also uses 1 when the parameter is absent.
40
40
- The query editor disables keyword autocompletion: raw mode is CQL/Lucene, and SQL keyword suggestions would only mislead.
Copy file name to clipboardExpand all lines: en/monitors/data-sources/data-sources.mdx
+53-3Lines changed: 53 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -103,7 +103,7 @@ Relational databases share a similar configuration structure:
103
103
|**Username**| Database username | - |
104
104
|**Password**| Database password | - |
105
105
106
-
Oracle uses only the basic connection settings above. MySQL and PostgreSQL additionally support TLS/SSL encrypted connections, selected via the **TLS/SSL mode** dropdown.
106
+
In addition to the basic connection settings above, Oracle supports multiple key-value **Options**. MySQL and PostgreSQL additionally support TLS/SSL encrypted connections, selected via the **TLS/SSL mode** dropdown.
107
107
108
108
#### TLS/SSL modes for MySQL
109
109
@@ -134,9 +134,59 @@ In "Verify certificate authority" and "Verify certificate and hostname" modes, a
134
134
Setting any mode other than "Disable TLS" requires all registered Edge instances in the associated alert engine cluster to be v0.50.0 or later.
These data sources have connection configurations similar to Prometheus, including server address, authentication, and TLS settings. The default server address for VictoriaLogs is `http://localhost:9428`. Refer to the creation form for specific parameters.
139
+
Elasticsearch supports Cloud and Self-Managed deployments. Cloud is selected by default.
140
+
141
+
| Config Item | Cloud | Self-Managed | Default |
142
+
|-------------|-------|--------------|---------|
143
+
|**Cloud ID**| Required | - | - |
144
+
|**API Key**| Required | - | - |
145
+
|**Connection URL**| - | Required; separate multiple nodes with commas | - |
Loki and VictoriaLogs use the same HTTP connection structure as Prometheus: server URL, Headers, Params, Basic Authentication, and TLS settings such as a custom CA, mTLS, server name, TLS versions, and skipping certificate verification.
156
+
157
+
| Type | Example server URL |
158
+
|------|--------------------|
159
+
|**Loki**|`http://localhost:3100`|
160
+
|**VictoriaLogs**|`http://localhost:9428`|
161
+
162
+
These addresses are input examples; the form does not save them as defaults automatically.
163
+
164
+
### ClickHouse
165
+
166
+
| Config Item | Description | Default |
167
+
|-------------|-------------|---------|
168
+
|**Connection URL**| ClickHouse Native protocol address; separate multiple nodes with commas | - |
169
+
|**Max Connections**| Maximum open connections in the pool | 32 |
170
+
|**Idle Connections**| Maximum idle connections in the pool | 4 |
171
+
|**Connection Lifetime (seconds)**| Maximum connection lifetime | 600 |
172
+
|**Query timeout (milliseconds)**| Timeout for each query | 5000 |
173
+
|**Maximum execution time (seconds)**| Query execution limit sent to ClickHouse | 60 |
174
+
|**Connection timeout (milliseconds)**| Timeout for establishing a connection | 2000 |
After you enable **TLS**, you can configure a custom CA, mTLS, server name, minimum / maximum TLS versions, and skipping server certificate verification. Disabling TLS clears these TLS fields from the form.
179
+
180
+
### Aliyun SLS
181
+
182
+
| Config Item | Description |
183
+
|-------------|-------------|
184
+
|**Endpoint**| SLS endpoint, such as `cn-hangzhou.log.aliyuncs.com`. Do not include an `http://` or `https://` prefix |
The SLS form does not provide separate TLS settings. AccessKey ID and AccessKey Secret support the Edge environment variable references described below.
0 commit comments