Log Detection¶
About This Document
This document is the second step in the detection rule configuration workflow. After completing the configuration, return to the main document to continue with Step 3: Event Notification.
The log detection feature monitors all log data generated by log collectors in the workspace. By configuring alert rules based on log keywords, you can quickly identify abnormal patterns that deviate from expected behavior (such as abnormal tags in log text or excessively high error rates), enabling timely detection and response to potential security threats or system issues.
It is suitable for detecting code anomalies or task scheduling issues in IT monitoring scenarios, such as monitoring an excessively high log error rate.
Detection Configuration¶
Detection Frequency¶
Sets the time interval for running detections.
-
Preset options: 1 minute, 5 minutes (default), 15 minutes, 30 minutes, 1 hour, 6 hours, 12 hours, and 24 hours;
-
Crontab mode: Click “Switch to Crontab Mode” to configure a custom schedule. Scheduled task execution can be configured based on periods such as seconds, minutes, hours, days, months, and weeks.
Detection Range¶
Sets the data time range queried for each detection run (❗️ The detection range must be greater than or equal to the detection frequency and must match the actual data reporting interval to avoid missed detections or false alarms).
- Preset options:
| Detection Frequency | Detection Range (Dropdown Options) |
|---|---|
| 1m | 1m/5m/15m/30m/1h/3h |
| 5m | 5m/15m/30m/1h/3h |
| 15m | 15m/30m/1h/3h/6h |
| 30m | 30m/1h/3h/6h |
| 1h | 1h/3h/6h/12h/24h |
| 6h | 6h/12h/24h |
| 12h | 12h/24h |
| 24h | 24h |
- Custom format: Enter a custom detection range, for example: 20m (last 20 minutes), 2h (last 2 hours), or 1d (last 1 day).
Detection Metric¶
Uses DQL to define the detection data source and aggregation method, monitoring the number of logs that contain the configured keywords in the log list of the specified detection object within a certain time range (❗️ Avoid selecting high-cardinality fields as detection dimensions. If configured improperly, overly loose trigger conditions may cause frequent alerts. The current query returns a maximum of 100,000 records).
Configuration Elements¶
| Configuration Item | Description |
|---|---|
| Index | The index to which the current detection metric belongs. Multiple indexes can be selected. ❗️ After configuring indexes in Logs > Indexes, when Logs is selected as the data source in chart queries, you can select log content corresponding to different indexes. The default index is default |
| Source | The data source of the current detection metric. You can select All (*) or a specific single data source |
| Keyword Search | Supports keyword search to match specific content in log text |
| Filter Conditions | Filters the detection metric data based on metric tags to limit the data range under detection. Supports one or more tag filters, including fuzzy match and fuzzy non-match conditions |
| Aggregation Algorithm | Defaults to "*", with the corresponding function count (counts the number of logs). If another field is selected, the function automatically changes to count distinct (counts unique data points) |
| Detection Dimensions | Any string (keyword) field in the configured data can be selected as a detection dimension. Up to three fields are supported as detection dimensions. A specific detection object is determined by combining multiple detection dimension fields, and the system evaluates whether the statistical metric of a detection object meets the trigger threshold. An event is generated if the condition is met.(For example, if the detection dimensions host and host_ip are selected, the detection object can be {host: host1, host_ip: 127.0.0.1}.)❗️ When the detection object is "log", status, host, service, source, and filename are used as detection dimensions by default |
| Query Method | Supports simple queries and expression queries. ❗️ If the query method is expression query and contains multiple queries, the log detection object is the same. For example, if the detection object of expression query A is "log", the detection object of expression query B is also "log" |
Click to view Query Method Details.
Trigger Conditions¶
Configure trigger conditions and severity levels. When a query returns multiple values, an event is generated if any value satisfies the trigger condition.
You can configure four severity thresholds: Critical, Error, Warning, and Info, as well as the Normal recovery condition.
| Severity | Configuration | Description |
|---|---|---|
| Critical | When Result >= [Value] |
Highest-severity alert; requires immediate action |
| Error | When Result >= [Value] |
High-severity alert; requires priority handling |
| Warning | When Result >= [Value] |
Medium-severity alert; requires attention |
| Info | When Result >= [Value] |
Low-severity alert; requires awareness |
| Normal | No event generated after [N] detections |
Once the detection rule takes effect, if the detection result returns to normal from an abnormal state (Critical, Error, Warning, or Info) within the configured number of detections, a recovery alert event is triggered. ❗️ Recovery alert events are not subject to Alert Muting. If no recovery detection count is configured, the alert event will not recover and will remain in the Events > Unrecovered Events list |
For more details, refer to Event Severity Levels.
Consecutive Trigger Determination¶
When enabled, an event is generated only when the trigger condition is continuously met, avoiding false alarms caused by transient fluctuations (❗️ The maximum configurable value is 10).
Bulk Alert Protection¶
Enabled by default.
When the number of alerts generated by a single detection run exceeds the preset threshold, the system automatically switches to the status-based summarization policy: instead of processing alert objects one by one, it generates and pushes a small number of summary alerts based on event status.
This ensures timely notification while significantly reducing alert noise and avoiding the risk of timeouts caused by processing too many alerts.
When this toggle is enabled, such event details generated after the monitor subsequently detects anomalies will not display history records or associated events.
Data Gaps¶
Handling strategy when the query result of the detection metric is empty within the detection range:
| Option | Description |
|---|---|
| Do not trigger events (default) | Uses the time range of the detection range and determines whether to generate an event based on the query result of the detection metric over the most recent minutes. Suitable for scenarios where missing data is acceptable |
| Treat query result as 0 | Uses the time range of the detection range, treats the query result of the detection metric over the most recent minutes as 0, and compares it again with the thresholds configured in Trigger Conditions above to determine whether to trigger an abnormal event |
| Custom fill and trigger events | Supports custom-filled values for the detection range and can trigger the following event types separately: Data Gap Event, Critical Event, Error Event, Warning Event, Info Event, and Recovery Event. ❗️ When selecting this strategy, we recommend configuring the custom data gap duration to be ≥ the detection range interval; if the configured duration is ≤ the detection range interval, both a data gap and an anomaly may be satisfied at the same time. In this case, the data gap handling result takes priority |
When trigger conditions, data gaps, and information generation are configured together, triggering is evaluated in the following priority order: Data gaps > Trigger conditions > Information event generation.
In other words: first determine whether a data gap exists, then determine whether a threshold is triggered, and finally determine whether an information event should be generated.
Information Generation¶
After enabling this option, you need to configure the information generation conditions. The system writes an "Info" event only when the detection result does not trigger any of the Critical, Error, Warning, or Info thresholds and the information generation conditions are met.
Suitable for scenarios where normal state changes or low-priority information needs to be recorded.
Subsequent Configuration¶
After completing the above detection configuration, continue with the following configurations:
-
Event Notification: Define the event title, content, notification members, data gap handling, and associated incidents;
-
Alert Configuration: Select the alert policy and configure notification targets and mute periods;
-
Associations: Associate a dashboard for quick access to view data;
-
Permissions: Set operation permissions to control who can edit or delete this monitor.