Creating alerts through the UI

Prereqs

You must grant permissions to users in your account to be able to launch the web UI and create alerts.

You must be an administrator of the IBM Log Analysis service, an administrator of the IBM Log Analysis instance, or have account IAM permissions to grant other users policies.

The following table lists the minimum policies that a user must have to be able to launch the IBM Log Analysis Web UI, and view logs:

For more information on how to configure these policies for a user, see Granting permissions to a user to view logs.

Step 1. Define the rule

You must define the rule that specifies the scope of the data and save the rule as a view.

Complete the following steps to create a rule:

1. Launch the IBM Log Analysis UI.

2. Filter log data by using pre-defined filters.

   You can filter logs by log source, application, and log level.

   • A source can be a host, a computer, a virtual machine, or a Heroku app.

   • An application represents a log file, a program, or a container.

   • Examples of log levels are: INFO, DEBUG, ERROR

   Complete the following steps to filter logs:

   1. Click the Views icon .

   2. Select EVERYTHING or a view.

   3. Expand Tags to see the list of tags that are identified in the logs. Then, choose the ones that you want.

   4. Expand Sources to see the list of log sources that are identified in the logs. Then, choose the ones that you want.

   5. Expand Apps to see the list of apps that are identified in the logs. Then, choose the ones that you want.

   6. Expand Levels to see the list of log levels that are identified in the logs. Then, choose the ones that you want.

   In each section, you can group multiple options into a group. Group tags, log sources, apps, and log levels to reuse these groupings when you filter log data in other custom views. To create a group, select multiple values. Then, click Save as group. Enter a name for the group, and save it.

3. Filter log data by adding a search query.

   When you search log data, the search applies any log filters and time queries configured in that view.

   You can do simple searches (single term string search), compound search (multiple search terms and operators), field searches if the log line can be parsed, and others. For more information, see How to Search Logs.

   AND and OR operators are case-sensitive and must be capitalized.

4. Create a view.

   1. Click the Views icon .

   2. Select EVERYTHING or a view.

   3. Filter log data then click Save as new view. The Create new view page opens.

   4. Enter a name for the view in the Name field.

   5. Optionally, add a category. Enter a name and then click Add this as new view category.

   6. Click Save View

Step 2. Create the alert

Next, you must attach an alert to the view.

You can choose any of the following options:

• Create a preset and attach the preset to the view
• Create a specific alert on the view.

You can attach multiple notification channels to a view. You can define different triggering conditions to each notification channel.