You can set additional conditions on metric alert output fields, so that only alerts satisfying these conditions are raised. To add an output filter for an alert:
- In the alert wizard, on the Triggering and propagation settings page, click the Output filters tab.
- Click Add filter group.
A new Filter group is displayed.
- From the list, select the element (a dimension, a unit of measure, an auxiliary metric value, or an alert comparison mode) that you want to filter on.
- Reporting group
- Software service
- Server IP address
- Server DNS name
- WAN Link
- Metric value
- Unit of measure
- Auxiliary metric value
- Auxiliary unit of measure
- Alarm triggering mode
- In the empty edit box, type the filter expression for the selected element.
Click the icon to see basic syntax guidelines.
See Filter syntax for more information on filters.
Basic usage example
Assume that in the detector settings you have defined a compound metric that reports on the percentage of slow operations in the total number of the detected operations, and that you selected operations as an auxiliary metric, so that the value of this metric could be reported in the notification message.
To have the alert raised only if the number of the operations exceeds 1000, add a filter group and select Auxiliary metric value from the element list, and then set the filter value to
>1000. Such a condition will be applied to the entire traffic, but you can make it apply only to selected dimensions such as specific software services. To do that, add another filter in the same filter group, choose Software service from the element list, and specify the service name as the filter value.
If you want the alert to be raised when the number of operations exceeds 1000 for software service A or 2000 for software service B, you need to have two separate filter groups, one for each software service.
For information on output filters for link performance alerts, see Configuring output filters for link performance alerts.