---
title: Define a custom Log Analytics alert rule in Health Log Analytics
description: Define a custom Log Analytics alert rule for log data that might not generate alerts automatically. A custom rule enables you to specify the metric, threshold, and alert properties directly.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/health-log-analytics/hla-op-alert-rule-add-sow.html
release: australia
product: Health Log Analytics
classification: health-log-analytics
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 3
keywords: [Health Log Analytics, log analytics alert rule, custom alert rules, define alert rule, Log viewer, search queries, alert thresholds, hit count, time period, persistence, alert conditions, log data, automatic alerts, metric alerts, alert properties, query filters, component selection, mathematical operators, time units, alert configuration]
breadcrumb: [Use custom alert rules, Managing alert generation, prioritization, anomaly detection, Health Log Analytics, ITOM AIOps, IT Operations Management]
---

# Define a custom Log Analytics alert rule in Health Log Analytics

Define a custom Log Analytics alert rule for log data that might not generate alerts automatically. A custom rule enables you to specify the metric, threshold, and alert properties directly.

## Before you begin

For background information, see [Alert rules in Health Log Analytics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-custom-alert-rules.md).

Role required: evt\_mgmt\_operator or evt\_mgmt\_admin

## Procedure

1.  Open the **Log Viewer** using one of the following methods:

    -   Navigate to **Workspaces** > **Service Operations Workspace** and select the Log Viewer icon \(\[Omitted image "icon-log-viewer-sow.png"\] Alt text: Log Viewer icon.\).
    -   While viewing log entries for an alert on the **Surrounding logs** tab, select **Log Viewer**.
2.  Define and run a search.

    For more information, see [Define, save, and share a log data search](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-op-search-queries-manage-sow.md).

3.  When a search returns log data that should generate an alert, select **Save** or **Save as** to save the search.

    **Note:** If you're using Health Log Analytics application, Version 20.0.11 - July 2021, and the Health Log Analytics Viewer application, Version 20.0.4 - July 2021, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home), you don't have to perform this step.

4.  Access the form for creating an alert rule by selecting **Define alert** at the top right of the **Log viewer** tab.

5.  On the form, provide the name and description for the alert rule.

    The name appears on the Anomaly card for generated alerts.

6.  Determine whether the rule generates alerts when the threshold conditions are met in the log data by setting the **State** field.

    To activate the rule, select **Enabled**.

7.  If you have installed the Health Log Analytics application, Version 20.0.11 - July 2021 , set the Severity value for the alert generated by this alert rule.

    -   **Low**: Attention is required even though the resource is still functional.
    -   **Medium**: Either performance has degraded or a partial, non-critical loss of functionality has occurred.
    -   **High**: Major functionality is severely impaired or performance has degraded.
    -   **Critical**: Immediate action is required. Either the resource is not functional or critical problems are imminent.
8.  If you have installed the Health Log Analytics application, Version 20.0.11 - July 2021, and the Health Log Analytics Viewer application, Version 20.0.4 - July 2021, fill in the details for the query.

<table id="table_sx2_sh1_gtb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Your query

</td><td>

The query to search for in the log data.By default, this is the query that was defined on the Log viewer. You can modify the query by adding search requirements to it.

 To search for all queries, specify an asterisk \(\*\).

</td></tr><tr><td>

Active filters

</td><td>

The filters defined for the query on the Log viewer. You can delete the filters.

</td></tr><tr><td>

Component

</td><td>

The component to which this alert rule applies.By default, this is the component that was defined on the Log viewer. You can choose a different component by selecting the search icon \(\[Omitted image "icon-search-sow.png"\] Alt text: Search icon.\) in the Component row and then selecting the required component from the list.

</td></tr></tbody>
</table>9.  Fill in the fields related to the threshold that will trigger the alert rule.

    |Field|Description|
    |-----|-----------|
    |Operator|Mathematical comparison operator that qualifies how the hit count triggers an alert of this kind. This field is automatically set to Bigger Than.|
    |Hit count|Number of matching log entries that serve as the trigger for an alert of this kind.|
    |Time period|Period of time over which the hit count is measured. The period is measured in the units specified by the **Time unit** value.|
    |Time unit|Units of the time period. This field is automatically set to minutes.|
    |Persistence|Time period over which the specified hit count per unit time must persist to trigger an alert of this kind. The field is automatically set to 1 minute.|

10. Select **Save**.


**Related topics**  


[Change a custom Log Analytics alert rule in Health Log Analytics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-op-defined-alert-modify-sow.md)

[Delete a custom Log Analytics alert rule in Health Log Analytics](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/health-log-analytics/hla-op-defined-alert-delete-sow.md)