Enabling IBM Cloud Event Notifications for IBM Cloud Logs

How events are collected and sent by IBM Cloud Logs

When an event of interest takes place in your IBM Cloud Logs instance, IBM Cloud Logs communicates with a connected Event Notifications instance to forward a notification to a supported destination.

Events for IBM Cloud Logs

The following table lists the IBM Cloud Logs events.

The following table lists the IBM Cloud Logs subtypes per event type related to alerts:

Enabling notifications

Events that are generated by an instance of the IBM Cloud Logs service can be forwarded to an Event Notifications service instance that is available in the same account. You can configure only one IBM Cloud Logs instance to one Event Notifications service instance.

Sending a test event to Event Notifications in the UI

After you enable notifications for IBM Cloud Logs, test your connection to ensure that the events that are generated by IBM Cloud Logs are being forwarded to Event Notifications.

Delivering notifications to select destinations

After you enable notifications for IBM Cloud Logs, create topics and subscriptions in Event Notifications so that alerts can be forwarded and delivered to your selected destinations.

For a complete list of supported destinations, see the Event Notifications documentation.

Notification payload details

Successful events that are generated by IBM Cloud Logs contain various fields that help you to identify the source and details of an event.

Event notifications from IBM Cloud Logs contain only metadata properties, such as names or identifiers of resources. Sensitive data, for example API keys or passwords, are not included in generated events.

The properties that are sent to Event Notifications vary depending on the event type and subtype. For example, if a StandardMoreThanAlertEvent:AlertTriggered event takes place in an instance for one or more public_cert secrets, IBM Cloud Logs sends a notification payload to Event Notifications that is similar to the following example.

{
   "data": {
      "alert_definition": {
         "alert_type": "StandardMoreThanAlertEvent",
         "condition": {
            "MoreThan": {
               "condition_threshold": 0,
               "condition_timeframe": 0
            }
         },
         "description": "",
         "id": "<alert_id>",
         "name": "<alert_name>",
         "query_statement": "_exists_:level",
         "severity": "ERROR"
      },
      "latest_event_timestamp": 0000000000000,
      "links": {
         "edit_alert": "https://dashboard.cxdev.eu-gb.logs.dev.appdomain.cloud/<instance_id>/#/alerts/<alert_id>",
         "view_alert": "https://dashboard.cxdev.eu-gb.logs.dev.appdomain.cloud/<instance_id>/#/insights?id=c9fe7539-e901-4745-b3ad-29ca0ae987a0"
      },
      "status": "triggered"
   },
   "datacontenttype": "application/json",
   "ibmendefaultlong": "Triggered: 2024-01-01T00:00:00Z",
   "ibmendefaultshort": "ERROR - new_groupBy",
   "ibmensourceid": "crn:v1:staging:public:logs:<region>:a/<account_id>:<instance_id>::",
   "id": "997355d5-4542-47fd-9868-84cf5df71e1b_c9fe7539-e901-4745-b3ad-29ca0ae987a0",
   "notification_id": "923873c0-2b42-4d4c-a9a0-c69339b16717",
   "source": "crn:v1:staging:public:logs:<region>:a/<account_id>:<instance_id>::",
   "time": "2024-01-01T00:00:00.000000Z",
   "type": "com.ibm.cloud.logs.<event_type>:<event_subtype>"
}

Review following table for more information about event notification properties.