Log alerts

A log alert records the query definition that identified a pattern, the start and end of its observed window, the match count and the source stream. The Log Operator can compare alerts against the same stream without losing the time interval that produced each count. A match count has meaning only with its query and window, so keep those values together when discussing whether an alert calls for action.

An open alert enters the team’s triage queue. The operator acknowledges it after taking responsibility for the review. Closing the alert indicates the triage has ended. The status path is simple and helps a Service Owner distinguish new signals from those already being examined. An alert can be investigated beside an incident when the service response needs ownership, priority and resolution times.

• Query evidence. The definition, stream and observed window identify the condition being reviewed.
• Triage state. Open, acknowledged and closed distinguish where each alert stands.
• Service context. The linked stream leads back to the service and its owner.

Work from the open alert list when a new signal arrives. Compare its recorded match count to other alerts for the same stream and read the window before contacting an incident responder. Keep the alert open while nobody has taken the review. Once a Log Operator acknowledges it, the responder can see that the signal has an owner.

Agree who defines queries and who may acknowledge an alert. The query definition is a record of the condition being tracked. Review it with the service team when the underlying service changes. Agree the unit and timezone for windows with the observability provider so two people interpret the same interval. Decide when an alert should prompt a new incident and when it belongs to an existing investigation.

Use a real stream during rehearsal. Capture a query window with a known match count, confirm that it appears in the open list, and have an operator acknowledge it. Review the status board before and after that action. The board should make the change visible without changing the original query or window.

Suppose a payment service stream reports an error pattern during a deployment window. The operator checks the query text, the recorded window and the match count. The stream points to the payment service, whose owner confirms the service is active. The operator acknowledges the alert, and an Incident Responder opens an incident against the affected service and asset. Later, the operator closes the alert after triage, while the incident continues to its own resolution. This keeps alert review and service repair as separate decisions.

• Open log alerts — Find open and acknowledged alerts with their query window and match count.
• Alert status board — Compare alerts across their triage states without a schedule column.
• Registered streams — Check the source and service behind an alert.

Follow stream registration and alert capture and alert to incident response.