Alerts Search Query Help
Fields
You can use field:value combination with most of alert fields.
Condition | Description |
---|---|
| Unix timestamp in milliseconds format. (1470394841148 -> Fri, 05 Aug 2016 11:00:41.148 GMT) |
| Unix timestamp in milliseconds format. (1470394841148 -> Fri, 05 Aug 2016 11:00:41.148 GMT) |
| Unix timestamp in milliseconds format. (1470394841148 -> Fri, 05 Aug 2016 11:00:41.148 GMT) |
| Id of the alert. |
| Short id assigned to the alert. Be careful, using this field is not recommended because it rolls. |
| Alias of the alert to be retrieved. Using alias will only retrieve an open alert with that alias if it exists. |
| If any source attempts to create a new alert where there is an open alert with the given alias, the count value of the open alert will be increased by one instead of creating another alert. |
| string |
| string |
| string |
| string |
| open | closed |
| Opsgenie Username |
| Opsgenie Username |
| Opsgenie Username |
| Opsgenie Username |
| true | false |
| true | false |
| true | false |
| Name of the team. |
| Name of the integration. |
| Type of the integration. |
| string |
| string |
Condition Operators
In addition of : exact match operator; you can also use <, <=, > and >= operators.
Examples |
---|
count > 5 |
count <= 4 |
lastOccurredAt < 1470394841148 |
Logical Operators
Combine multiple value(s) by using AND and OR operators. Just don't forget to wrap them with ( ) parentheses.
Example | Description |
---|---|
message: (lorem OR ipsum) |
|
description: (lorem AND ipsum) |
|
Also you can combine multiple condition(s) by using AND and OR operators.
Examples |
---|
message: lorem AND count >= 3 |
message: (lorem OR ipsum) AND count >= 3 |
status: open AND (count >= 3 OR entity:lipsum) |
Use the NOT search query to disqualify search results for a certain value.
Examples | Description |
---|---|
message: NOT lorem |
|
status: NOT open |
|
Asterisk (*) Wildcard Usage
Asterisk (*) character can be used as a substitute for any of a class of characters in a search. It is often used in place of one or more characters when you do not know what the real character is or you do not want to type the entire name. If you are looking for an alert that you know "message" field starts with "lorem" but you cannot remember the rest of the field, type the following:
Examples |
---|
message: lorem* |
lorem* |
Updated 29 days ago