openapi: 3.0.3 info: contact: email: support@signoz.io name: SigNoz Support url: https://signoz.io description: OpenTelemetry-Native Logs, Metrics and Traces in a single pane termsOfService: https://signoz.io/terms-of-service/ title: SigNoz alerts rules API version: '' servers: - description: The fully qualified URL to the SigNoz APIServer. url: https://{host}:{port}{base_path} variables: base_path: default: / description: The base path of the SigNoz APIServer host: default: localhost description: The host of the SigNoz APIServer port: default: '8080' description: The port of the SigNoz APIServer tags: - name: rules paths: /api/v2/rules: get: deprecated: false description: This endpoint lists all alert rules with their current evaluation state operationId: ListRules responses: '200': content: application/json: schema: properties: data: items: $ref: '#/components/schemas/RuletypesRule' type: array status: type: string required: - status - data type: object description: OK '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - VIEWER - tokenizer: - VIEWER summary: List alert rules tags: - rules post: deprecated: false description: This endpoint creates a new alert rule operationId: CreateRule requestBody: content: application/json: examples: logs_error_rate_formula: description: Two disabled log count queries (A = errors, B = total) combined via a builder_formula into a percentage. Classic service-level error-rate alert pattern for log-based signals. summary: Logs error rate error count / total count × 100 value: alert: Payments-api error log rate above 1% alertType: LOGS_BASED_ALERT annotations: description: Error log rate in {{$deployment.environment}} is {{$value}}% summary: Payments-api error rate above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'payments-api' AND severity_text IN ['ERROR', 'FATAL'] groupBy: - fieldContext: resource fieldDataType: string name: deployment.environment name: A signal: logs stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'payments-api' groupBy: - fieldContext: resource fieldDataType: string name: deployment.environment name: B signal: logs stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{deployment.environment}}' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-payments matchType: at_least_once name: critical op: above target: 1 description: Error log ratio as a percentage of total logs for payments-api evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: payments notificationSettings: groupBy: - deployment.environment renotify: alertStates: - firing enabled: true interval: 30m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 logs_threshold: description: Counts matching log records (ERROR severity + body contains) over a rolling window. Fires at least once per evaluation when the count exceeds zero. summary: Logs threshold count() over filter value: alert: Payments service panic logs alertType: LOGS_BASED_ALERT annotations: description: '{{$k8s.pod.name}} emitted {{$value}} panic log(s) in {{$deployment.environment}}.' summary: Payments service panic condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() filter: expression: service.name = 'payments-api' AND severity_text = 'ERROR' AND body CONTAINS 'panic' groupBy: - fieldContext: resource fieldDataType: string name: k8s.pod.name - fieldContext: resource fieldDataType: string name: deployment.environment legend: '{{k8s.pod.name}} ({{deployment.environment}})' name: A signal: logs stepInterval: 60 type: builder_query queryType: builder selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-payments - pagerduty-payments matchType: at_least_once name: critical op: above target: 0 description: Any panic log line emitted by the payments service evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: payments notificationSettings: groupBy: - k8s.pod.name - deployment.environment renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 metric_anomaly: description: Anomaly rules are not yet supported under schemaVersion v2alpha1, so this example uses the v1 shape. Wraps a builder query in the `anomaly` function with daily seasonality SigNoz compares each point against the forecast for that time of day. Fires when the anomaly score stays below the threshold for the entire window; `requireMinPoints` guards against noisy intervals. summary: Metric anomaly rule (v1 only) value: alert: Anomalous drop in ingested spans alertType: METRIC_BASED_ALERT annotations: description: Ingestion rate for tenant {{$tenant_id}} is anomalously low (z-score {{$value}}). summary: Span ingestion anomaly condition: algorithm: standard compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: otelcol_receiver_accepted_spans spaceAggregation: sum timeAggregation: rate filter: expression: tenant_tier = 'premium' functions: - args: - name: z_score_threshold value: 2 name: anomaly groupBy: - fieldContext: attribute fieldDataType: string name: tenant_id legend: '{{tenant_id}}' name: A signal: metrics stepInterval: 21600 type: builder_query queryType: builder matchType: all_the_times op: below requireMinPoints: true requiredNumPoints: 3 seasonality: daily selectedQueryName: A target: 2 description: Detect an abrupt drop in span ingestion using a z-score anomaly function evalWindow: 24h frequency: 3h labels: severity: warning preferredChannels: - slack-ingestion ruleType: anomaly_rule version: v5 metric_promql: description: PromQL expression instead of the builder. Dotted OTEL resource attributes are quoted ("deployment.environment"). Useful for queries that combine series with group_right or other Prom operators. summary: Metric threshold PromQL rule value: alert: Kafka consumer group lag above 1000 alertType: METRIC_BASED_ALERT annotations: description: Consumer group {{$group}} is {{$value}} messages behind on {{$topic}}/{{$partition}}. summary: Kafka consumer lag high condition: compositeQuery: panelType: graph queries: - spec: legend: '{{topic}}/{{partition}} ({{group}})' name: A query: (max by(topic, partition, "deployment.environment")(kafka_log_end_offset) - on(topic, partition, "deployment.environment") group_right max by(group, topic, partition, "deployment.environment")(kafka_consumer_committed_offset)) > 0 type: promql queryType: promql selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-data-platform - pagerduty-data matchType: all_the_times name: critical op: above target: 1000 description: Consumer group lag computed via PromQL evaluation: kind: rolling spec: evalWindow: 10m frequency: 1m labels: severity: critical notificationSettings: groupBy: - group - topic renotify: alertStates: - firing enabled: true interval: 1h ruleType: promql_rule schemaVersion: v2alpha1 version: v5 metric_threshold_formula: description: Computes disk utilization as (1 - available/capacity) * 100 by combining two disabled base queries with a builder_formula. The formula emits 0–100, so compositeQuery.unit is set to "percent" and the target is a bare number. summary: Metric threshold multi-query formula value: alert: PersistentVolume above 80% utilization alertType: METRIC_BASED_ALERT annotations: description: Volume {{$k8s.persistentvolumeclaim.name}} in {{$k8s.namespace.name}} is {{$value}}% full. summary: Disk utilization above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: k8s.volume.available spaceAggregation: max timeAggregation: max disabled: true filter: expression: k8s.volume.type = 'persistentVolumeClaim' groupBy: - fieldContext: resource fieldDataType: string name: k8s.persistentvolumeclaim.name - fieldContext: resource fieldDataType: string name: k8s.namespace.name name: A signal: metrics stepInterval: 60 type: builder_query - spec: aggregations: - metricName: k8s.volume.capacity spaceAggregation: max timeAggregation: max disabled: true filter: expression: k8s.volume.type = 'persistentVolumeClaim' groupBy: - fieldContext: resource fieldDataType: string name: k8s.persistentvolumeclaim.name - fieldContext: resource fieldDataType: string name: k8s.namespace.name name: B signal: metrics stepInterval: 60 type: builder_query - spec: expression: (1 - A/B) * 100 legend: '{{k8s.persistentvolumeclaim.name}} ({{k8s.namespace.name}})' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-storage matchType: at_least_once name: critical op: above target: 80 description: Disk utilization for a persistent volume is above 80% evaluation: kind: rolling spec: evalWindow: 30m frequency: 5m labels: severity: critical notificationSettings: groupBy: - k8s.namespace.name - k8s.persistentvolumeclaim.name renotify: alertStates: - firing enabled: true interval: 2h ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 metric_threshold_single: description: Fires when a pod consumes more than 80% of its requested CPU for the whole evaluation window. Uses `k8s.pod.cpu_request_utilization`. summary: Metric threshold single builder query value: alert: Pod CPU above 80% of request alertType: METRIC_BASED_ALERT annotations: description: Pod {{$k8s.pod.name}} CPU is at {{$value}} of request in {{$deployment.environment}}. summary: Pod CPU above {{$threshold}} of request condition: compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: k8s.pod.cpu_request_utilization spaceAggregation: max timeAggregation: avg filter: expression: k8s.deployment.name = 'api-service' groupBy: - fieldContext: resource fieldDataType: string name: k8s.pod.name - fieldContext: resource fieldDataType: string name: deployment.environment legend: '{{k8s.pod.name}} ({{deployment.environment}})' name: A signal: metrics stepInterval: 60 type: builder_query queryType: builder unit: percentunit selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-platform - pagerduty-oncall matchType: all_the_times name: critical op: above target: 0.8 description: CPU usage for api-service pods exceeds 80% of the requested CPU evaluation: kind: rolling spec: evalWindow: 15m frequency: 1m labels: severity: critical team: platform notificationSettings: groupBy: - k8s.pod.name - deployment.environment renotify: alertStates: - firing enabled: true interval: 4h ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 notification_settings: description: 'Demonstrates the full notificationSettings surface: `groupBy` merges alerts across labels to cut noise, `newGroupEvalDelay` gives newly-appearing series a grace period before firing, `renotify` re-alerts every 30m while firing OR while the alert is in nodata (missing data is treated as actionable), and `usePolicy: false` means channels come from the threshold entries rather than global routing policies. Set `usePolicy: true` to skip per-threshold channels and route via the org-level notification policy instead.' summary: Full notification settings (grouping, nodata renotify, grace period) value: alert: API 5xx error rate above 1% alertType: TRACES_BASED_ALERT annotations: description: '{{$service.name}} 5xx rate in {{$deployment.environment}} is {{$value}}%.' summary: API service error rate elevated condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name CONTAINS 'api' AND http.status_code >= 500 groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: resource fieldDataType: string name: deployment.environment name: A signal: traces stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name CONTAINS 'api' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: resource fieldDataType: string name: deployment.environment name: B signal: traces stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{service.name}} ({{deployment.environment}})' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-api-alerts - pagerduty-oncall matchType: at_least_once name: critical op: above target: 1 description: Noise-controlled 5xx error rate alert with renotify on gaps evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: team: platform notificationSettings: groupBy: - service.name - deployment.environment newGroupEvalDelay: 2m renotify: alertStates: - firing - nodata enabled: true interval: 30m usePolicy: false ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 tiered_thresholds: description: Two tiers (warning and critical) in a single rule, each with its own target, op, matchType, and channels so warnings and pages route to different receivers. `alertOnAbsent` + `absentFor` fires a no-data alert when the query returns no series for 15 consecutive evaluations. summary: Tiered thresholds with per-tier channels value: alert: Kafka consumer lag warn / critical alertType: METRIC_BASED_ALERT annotations: description: Consumer lag for {{$topic}} partition {{$partition}} is {{$value}}. summary: Kafka consumer lag condition: absentFor: 15 alertOnAbsent: true compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: kafka_log_end_offset spaceAggregation: max timeAggregation: max disabled: true filter: expression: topic != '__consumer_offsets' groupBy: - fieldContext: attribute fieldDataType: string name: topic - fieldContext: attribute fieldDataType: string name: partition name: A signal: metrics stepInterval: 60 type: builder_query - spec: aggregations: - metricName: kafka_consumer_committed_offset spaceAggregation: max timeAggregation: max disabled: true filter: expression: topic != '__consumer_offsets' groupBy: - fieldContext: attribute fieldDataType: string name: topic - fieldContext: attribute fieldDataType: string name: partition name: B signal: metrics stepInterval: 60 type: builder_query - spec: expression: A - B legend: '{{topic}}/{{partition}}' name: F1 type: builder_formula queryType: builder selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-kafka-info matchType: all_the_times name: warning op: above target: 50 - channels: - slack-kafka-alerts - pagerduty-kafka matchType: all_the_times name: critical op: above target: 200 description: Warn at lag ≥ 50 and page at ≥ 200, tiered via thresholds.spec. evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: team: data-platform notificationSettings: groupBy: - topic renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 traces_error_rate_formula: description: Two disabled trace count queries (A = error spans where hasError=true, B = total spans) combined via a builder_formula into a percentage. Mirrors the common request-error-rate dashboard shape. summary: Traces error rate error spans / total spans × 100 value: alert: Search-api error rate above 5% alertType: TRACES_BASED_ALERT annotations: description: Error rate on {{$service.name}} {{$http.route}} is {{$value}}% summary: Search-api error rate above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'search-api' AND hasError = true groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route name: A signal: traces stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'search-api' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route name: B signal: traces stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{service.name}} {{http.route}}' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-search - pagerduty-search matchType: at_least_once name: critical op: above target: 5 description: Request error rate for search-api, grouped by route evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: search notificationSettings: groupBy: - service.name - http.route renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 traces_threshold_latency: description: Builder query against the traces signal with p99(duration_nano). The series unit is ns (compositeQuery.unit), the target is in seconds (threshold.targetUnit) SigNoz converts before comparing. Canonical shape when series and target live in different units. summary: Traces threshold p99 latency (ns → s conversion) value: alert: Search API p99 latency above 5s alertType: TRACES_BASED_ALERT annotations: description: p99 latency for {{$service.name}} on {{$http.route}} crossed {{$threshold}}s. summary: Search-api latency degraded condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: p99(duration_nano) filter: expression: service.name = 'search-api' AND name = 'GET /api/v1/search' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route legend: '{{service.name}} {{http.route}}' name: A signal: traces stepInterval: 60 type: builder_query queryType: builder unit: ns selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-search matchType: at_least_once name: warning op: above target: 5 targetUnit: s description: p99 duration of the search endpoint exceeds 5s evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: warning team: search notificationSettings: groupBy: - service.name - http.route renotify: alertStates: - firing enabled: true interval: 30m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 schema: $ref: '#/components/schemas/RuletypesPostableRule' responses: '201': content: application/json: schema: properties: data: $ref: '#/components/schemas/RuletypesRule' status: type: string required: - status - data type: object description: Created '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - EDITOR - tokenizer: - EDITOR summary: Create alert rule tags: - rules /api/v2/rules/{id}: delete: deprecated: false description: This endpoint deletes an alert rule by ID operationId: DeleteRuleByID parameters: - in: path name: id required: true schema: type: string responses: '204': description: No Content '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - EDITOR - tokenizer: - EDITOR summary: Delete alert rule tags: - rules get: deprecated: false description: This endpoint returns an alert rule by ID operationId: GetRuleByID parameters: - in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/RuletypesRule' status: type: string required: - status - data type: object description: OK '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - VIEWER - tokenizer: - VIEWER summary: Get alert rule by ID tags: - rules patch: deprecated: false description: This endpoint applies a partial update to an alert rule by ID operationId: PatchRuleByID parameters: - in: path name: id required: true schema: type: string requestBody: content: application/json: examples: logs_error_rate_formula: description: Two disabled log count queries (A = errors, B = total) combined via a builder_formula into a percentage. Classic service-level error-rate alert pattern for log-based signals. summary: Logs error rate error count / total count × 100 value: alert: Payments-api error log rate above 1% alertType: LOGS_BASED_ALERT annotations: description: Error log rate in {{$deployment.environment}} is {{$value}}% summary: Payments-api error rate above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'payments-api' AND severity_text IN ['ERROR', 'FATAL'] groupBy: - fieldContext: resource fieldDataType: string name: deployment.environment name: A signal: logs stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'payments-api' groupBy: - fieldContext: resource fieldDataType: string name: deployment.environment name: B signal: logs stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{deployment.environment}}' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-payments matchType: at_least_once name: critical op: above target: 1 description: Error log ratio as a percentage of total logs for payments-api evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: payments notificationSettings: groupBy: - deployment.environment renotify: alertStates: - firing enabled: true interval: 30m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 logs_threshold: description: Counts matching log records (ERROR severity + body contains) over a rolling window. Fires at least once per evaluation when the count exceeds zero. summary: Logs threshold count() over filter value: alert: Payments service panic logs alertType: LOGS_BASED_ALERT annotations: description: '{{$k8s.pod.name}} emitted {{$value}} panic log(s) in {{$deployment.environment}}.' summary: Payments service panic condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() filter: expression: service.name = 'payments-api' AND severity_text = 'ERROR' AND body CONTAINS 'panic' groupBy: - fieldContext: resource fieldDataType: string name: k8s.pod.name - fieldContext: resource fieldDataType: string name: deployment.environment legend: '{{k8s.pod.name}} ({{deployment.environment}})' name: A signal: logs stepInterval: 60 type: builder_query queryType: builder selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-payments - pagerduty-payments matchType: at_least_once name: critical op: above target: 0 description: Any panic log line emitted by the payments service evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: payments notificationSettings: groupBy: - k8s.pod.name - deployment.environment renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 metric_anomaly: description: Anomaly rules are not yet supported under schemaVersion v2alpha1, so this example uses the v1 shape. Wraps a builder query in the `anomaly` function with daily seasonality SigNoz compares each point against the forecast for that time of day. Fires when the anomaly score stays below the threshold for the entire window; `requireMinPoints` guards against noisy intervals. summary: Metric anomaly rule (v1 only) value: alert: Anomalous drop in ingested spans alertType: METRIC_BASED_ALERT annotations: description: Ingestion rate for tenant {{$tenant_id}} is anomalously low (z-score {{$value}}). summary: Span ingestion anomaly condition: algorithm: standard compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: otelcol_receiver_accepted_spans spaceAggregation: sum timeAggregation: rate filter: expression: tenant_tier = 'premium' functions: - args: - name: z_score_threshold value: 2 name: anomaly groupBy: - fieldContext: attribute fieldDataType: string name: tenant_id legend: '{{tenant_id}}' name: A signal: metrics stepInterval: 21600 type: builder_query queryType: builder matchType: all_the_times op: below requireMinPoints: true requiredNumPoints: 3 seasonality: daily selectedQueryName: A target: 2 description: Detect an abrupt drop in span ingestion using a z-score anomaly function evalWindow: 24h frequency: 3h labels: severity: warning preferredChannels: - slack-ingestion ruleType: anomaly_rule version: v5 metric_promql: description: PromQL expression instead of the builder. Dotted OTEL resource attributes are quoted ("deployment.environment"). Useful for queries that combine series with group_right or other Prom operators. summary: Metric threshold PromQL rule value: alert: Kafka consumer group lag above 1000 alertType: METRIC_BASED_ALERT annotations: description: Consumer group {{$group}} is {{$value}} messages behind on {{$topic}}/{{$partition}}. summary: Kafka consumer lag high condition: compositeQuery: panelType: graph queries: - spec: legend: '{{topic}}/{{partition}} ({{group}})' name: A query: (max by(topic, partition, "deployment.environment")(kafka_log_end_offset) - on(topic, partition, "deployment.environment") group_right max by(group, topic, partition, "deployment.environment")(kafka_consumer_committed_offset)) > 0 type: promql queryType: promql selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-data-platform - pagerduty-data matchType: all_the_times name: critical op: above target: 1000 description: Consumer group lag computed via PromQL evaluation: kind: rolling spec: evalWindow: 10m frequency: 1m labels: severity: critical notificationSettings: groupBy: - group - topic renotify: alertStates: - firing enabled: true interval: 1h ruleType: promql_rule schemaVersion: v2alpha1 version: v5 metric_threshold_formula: description: Computes disk utilization as (1 - available/capacity) * 100 by combining two disabled base queries with a builder_formula. The formula emits 0–100, so compositeQuery.unit is set to "percent" and the target is a bare number. summary: Metric threshold multi-query formula value: alert: PersistentVolume above 80% utilization alertType: METRIC_BASED_ALERT annotations: description: Volume {{$k8s.persistentvolumeclaim.name}} in {{$k8s.namespace.name}} is {{$value}}% full. summary: Disk utilization above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: k8s.volume.available spaceAggregation: max timeAggregation: max disabled: true filter: expression: k8s.volume.type = 'persistentVolumeClaim' groupBy: - fieldContext: resource fieldDataType: string name: k8s.persistentvolumeclaim.name - fieldContext: resource fieldDataType: string name: k8s.namespace.name name: A signal: metrics stepInterval: 60 type: builder_query - spec: aggregations: - metricName: k8s.volume.capacity spaceAggregation: max timeAggregation: max disabled: true filter: expression: k8s.volume.type = 'persistentVolumeClaim' groupBy: - fieldContext: resource fieldDataType: string name: k8s.persistentvolumeclaim.name - fieldContext: resource fieldDataType: string name: k8s.namespace.name name: B signal: metrics stepInterval: 60 type: builder_query - spec: expression: (1 - A/B) * 100 legend: '{{k8s.persistentvolumeclaim.name}} ({{k8s.namespace.name}})' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-storage matchType: at_least_once name: critical op: above target: 80 description: Disk utilization for a persistent volume is above 80% evaluation: kind: rolling spec: evalWindow: 30m frequency: 5m labels: severity: critical notificationSettings: groupBy: - k8s.namespace.name - k8s.persistentvolumeclaim.name renotify: alertStates: - firing enabled: true interval: 2h ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 metric_threshold_single: description: Fires when a pod consumes more than 80% of its requested CPU for the whole evaluation window. Uses `k8s.pod.cpu_request_utilization`. summary: Metric threshold single builder query value: alert: Pod CPU above 80% of request alertType: METRIC_BASED_ALERT annotations: description: Pod {{$k8s.pod.name}} CPU is at {{$value}} of request in {{$deployment.environment}}. summary: Pod CPU above {{$threshold}} of request condition: compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: k8s.pod.cpu_request_utilization spaceAggregation: max timeAggregation: avg filter: expression: k8s.deployment.name = 'api-service' groupBy: - fieldContext: resource fieldDataType: string name: k8s.pod.name - fieldContext: resource fieldDataType: string name: deployment.environment legend: '{{k8s.pod.name}} ({{deployment.environment}})' name: A signal: metrics stepInterval: 60 type: builder_query queryType: builder unit: percentunit selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-platform - pagerduty-oncall matchType: all_the_times name: critical op: above target: 0.8 description: CPU usage for api-service pods exceeds 80% of the requested CPU evaluation: kind: rolling spec: evalWindow: 15m frequency: 1m labels: severity: critical team: platform notificationSettings: groupBy: - k8s.pod.name - deployment.environment renotify: alertStates: - firing enabled: true interval: 4h ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 notification_settings: description: 'Demonstrates the full notificationSettings surface: `groupBy` merges alerts across labels to cut noise, `newGroupEvalDelay` gives newly-appearing series a grace period before firing, `renotify` re-alerts every 30m while firing OR while the alert is in nodata (missing data is treated as actionable), and `usePolicy: false` means channels come from the threshold entries rather than global routing policies. Set `usePolicy: true` to skip per-threshold channels and route via the org-level notification policy instead.' summary: Full notification settings (grouping, nodata renotify, grace period) value: alert: API 5xx error rate above 1% alertType: TRACES_BASED_ALERT annotations: description: '{{$service.name}} 5xx rate in {{$deployment.environment}} is {{$value}}%.' summary: API service error rate elevated condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name CONTAINS 'api' AND http.status_code >= 500 groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: resource fieldDataType: string name: deployment.environment name: A signal: traces stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name CONTAINS 'api' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: resource fieldDataType: string name: deployment.environment name: B signal: traces stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{service.name}} ({{deployment.environment}})' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-api-alerts - pagerduty-oncall matchType: at_least_once name: critical op: above target: 1 description: Noise-controlled 5xx error rate alert with renotify on gaps evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: team: platform notificationSettings: groupBy: - service.name - deployment.environment newGroupEvalDelay: 2m renotify: alertStates: - firing - nodata enabled: true interval: 30m usePolicy: false ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 tiered_thresholds: description: Two tiers (warning and critical) in a single rule, each with its own target, op, matchType, and channels so warnings and pages route to different receivers. `alertOnAbsent` + `absentFor` fires a no-data alert when the query returns no series for 15 consecutive evaluations. summary: Tiered thresholds with per-tier channels value: alert: Kafka consumer lag warn / critical alertType: METRIC_BASED_ALERT annotations: description: Consumer lag for {{$topic}} partition {{$partition}} is {{$value}}. summary: Kafka consumer lag condition: absentFor: 15 alertOnAbsent: true compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: kafka_log_end_offset spaceAggregation: max timeAggregation: max disabled: true filter: expression: topic != '__consumer_offsets' groupBy: - fieldContext: attribute fieldDataType: string name: topic - fieldContext: attribute fieldDataType: string name: partition name: A signal: metrics stepInterval: 60 type: builder_query - spec: aggregations: - metricName: kafka_consumer_committed_offset spaceAggregation: max timeAggregation: max disabled: true filter: expression: topic != '__consumer_offsets' groupBy: - fieldContext: attribute fieldDataType: string name: topic - fieldContext: attribute fieldDataType: string name: partition name: B signal: metrics stepInterval: 60 type: builder_query - spec: expression: A - B legend: '{{topic}}/{{partition}}' name: F1 type: builder_formula queryType: builder selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-kafka-info matchType: all_the_times name: warning op: above target: 50 - channels: - slack-kafka-alerts - pagerduty-kafka matchType: all_the_times name: critical op: above target: 200 description: Warn at lag ≥ 50 and page at ≥ 200, tiered via thresholds.spec. evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: team: data-platform notificationSettings: groupBy: - topic renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 traces_error_rate_formula: description: Two disabled trace count queries (A = error spans where hasError=true, B = total spans) combined via a builder_formula into a percentage. Mirrors the common request-error-rate dashboard shape. summary: Traces error rate error spans / total spans × 100 value: alert: Search-api error rate above 5% alertType: TRACES_BASED_ALERT annotations: description: Error rate on {{$service.name}} {{$http.route}} is {{$value}}% summary: Search-api error rate above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'search-api' AND hasError = true groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route name: A signal: traces stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'search-api' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route name: B signal: traces stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{service.name}} {{http.route}}' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-search - pagerduty-search matchType: at_least_once name: critical op: above target: 5 description: Request error rate for search-api, grouped by route evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: search notificationSettings: groupBy: - service.name - http.route renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 traces_threshold_latency: description: Builder query against the traces signal with p99(duration_nano). The series unit is ns (compositeQuery.unit), the target is in seconds (threshold.targetUnit) SigNoz converts before comparing. Canonical shape when series and target live in different units. summary: Traces threshold p99 latency (ns → s conversion) value: alert: Search API p99 latency above 5s alertType: TRACES_BASED_ALERT annotations: description: p99 latency for {{$service.name}} on {{$http.route}} crossed {{$threshold}}s. summary: Search-api latency degraded condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: p99(duration_nano) filter: expression: service.name = 'search-api' AND name = 'GET /api/v1/search' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route legend: '{{service.name}} {{http.route}}' name: A signal: traces stepInterval: 60 type: builder_query queryType: builder unit: ns selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-search matchType: at_least_once name: warning op: above target: 5 targetUnit: s description: p99 duration of the search endpoint exceeds 5s evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: warning team: search notificationSettings: groupBy: - service.name - http.route renotify: alertStates: - firing enabled: true interval: 30m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 schema: $ref: '#/components/schemas/RuletypesPostableRule' responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/RuletypesRule' status: type: string required: - status - data type: object description: OK '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - EDITOR - tokenizer: - EDITOR summary: Patch alert rule tags: - rules put: deprecated: false description: This endpoint updates an alert rule by ID operationId: UpdateRuleByID parameters: - in: path name: id required: true schema: type: string requestBody: content: application/json: examples: logs_error_rate_formula: description: Two disabled log count queries (A = errors, B = total) combined via a builder_formula into a percentage. Classic service-level error-rate alert pattern for log-based signals. summary: Logs error rate error count / total count × 100 value: alert: Payments-api error log rate above 1% alertType: LOGS_BASED_ALERT annotations: description: Error log rate in {{$deployment.environment}} is {{$value}}% summary: Payments-api error rate above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'payments-api' AND severity_text IN ['ERROR', 'FATAL'] groupBy: - fieldContext: resource fieldDataType: string name: deployment.environment name: A signal: logs stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'payments-api' groupBy: - fieldContext: resource fieldDataType: string name: deployment.environment name: B signal: logs stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{deployment.environment}}' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-payments matchType: at_least_once name: critical op: above target: 1 description: Error log ratio as a percentage of total logs for payments-api evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: payments notificationSettings: groupBy: - deployment.environment renotify: alertStates: - firing enabled: true interval: 30m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 logs_threshold: description: Counts matching log records (ERROR severity + body contains) over a rolling window. Fires at least once per evaluation when the count exceeds zero. summary: Logs threshold count() over filter value: alert: Payments service panic logs alertType: LOGS_BASED_ALERT annotations: description: '{{$k8s.pod.name}} emitted {{$value}} panic log(s) in {{$deployment.environment}}.' summary: Payments service panic condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() filter: expression: service.name = 'payments-api' AND severity_text = 'ERROR' AND body CONTAINS 'panic' groupBy: - fieldContext: resource fieldDataType: string name: k8s.pod.name - fieldContext: resource fieldDataType: string name: deployment.environment legend: '{{k8s.pod.name}} ({{deployment.environment}})' name: A signal: logs stepInterval: 60 type: builder_query queryType: builder selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-payments - pagerduty-payments matchType: at_least_once name: critical op: above target: 0 description: Any panic log line emitted by the payments service evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: payments notificationSettings: groupBy: - k8s.pod.name - deployment.environment renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 metric_anomaly: description: Anomaly rules are not yet supported under schemaVersion v2alpha1, so this example uses the v1 shape. Wraps a builder query in the `anomaly` function with daily seasonality SigNoz compares each point against the forecast for that time of day. Fires when the anomaly score stays below the threshold for the entire window; `requireMinPoints` guards against noisy intervals. summary: Metric anomaly rule (v1 only) value: alert: Anomalous drop in ingested spans alertType: METRIC_BASED_ALERT annotations: description: Ingestion rate for tenant {{$tenant_id}} is anomalously low (z-score {{$value}}). summary: Span ingestion anomaly condition: algorithm: standard compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: otelcol_receiver_accepted_spans spaceAggregation: sum timeAggregation: rate filter: expression: tenant_tier = 'premium' functions: - args: - name: z_score_threshold value: 2 name: anomaly groupBy: - fieldContext: attribute fieldDataType: string name: tenant_id legend: '{{tenant_id}}' name: A signal: metrics stepInterval: 21600 type: builder_query queryType: builder matchType: all_the_times op: below requireMinPoints: true requiredNumPoints: 3 seasonality: daily selectedQueryName: A target: 2 description: Detect an abrupt drop in span ingestion using a z-score anomaly function evalWindow: 24h frequency: 3h labels: severity: warning preferredChannels: - slack-ingestion ruleType: anomaly_rule version: v5 metric_promql: description: PromQL expression instead of the builder. Dotted OTEL resource attributes are quoted ("deployment.environment"). Useful for queries that combine series with group_right or other Prom operators. summary: Metric threshold PromQL rule value: alert: Kafka consumer group lag above 1000 alertType: METRIC_BASED_ALERT annotations: description: Consumer group {{$group}} is {{$value}} messages behind on {{$topic}}/{{$partition}}. summary: Kafka consumer lag high condition: compositeQuery: panelType: graph queries: - spec: legend: '{{topic}}/{{partition}} ({{group}})' name: A query: (max by(topic, partition, "deployment.environment")(kafka_log_end_offset) - on(topic, partition, "deployment.environment") group_right max by(group, topic, partition, "deployment.environment")(kafka_consumer_committed_offset)) > 0 type: promql queryType: promql selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-data-platform - pagerduty-data matchType: all_the_times name: critical op: above target: 1000 description: Consumer group lag computed via PromQL evaluation: kind: rolling spec: evalWindow: 10m frequency: 1m labels: severity: critical notificationSettings: groupBy: - group - topic renotify: alertStates: - firing enabled: true interval: 1h ruleType: promql_rule schemaVersion: v2alpha1 version: v5 metric_threshold_formula: description: Computes disk utilization as (1 - available/capacity) * 100 by combining two disabled base queries with a builder_formula. The formula emits 0–100, so compositeQuery.unit is set to "percent" and the target is a bare number. summary: Metric threshold multi-query formula value: alert: PersistentVolume above 80% utilization alertType: METRIC_BASED_ALERT annotations: description: Volume {{$k8s.persistentvolumeclaim.name}} in {{$k8s.namespace.name}} is {{$value}}% full. summary: Disk utilization above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: k8s.volume.available spaceAggregation: max timeAggregation: max disabled: true filter: expression: k8s.volume.type = 'persistentVolumeClaim' groupBy: - fieldContext: resource fieldDataType: string name: k8s.persistentvolumeclaim.name - fieldContext: resource fieldDataType: string name: k8s.namespace.name name: A signal: metrics stepInterval: 60 type: builder_query - spec: aggregations: - metricName: k8s.volume.capacity spaceAggregation: max timeAggregation: max disabled: true filter: expression: k8s.volume.type = 'persistentVolumeClaim' groupBy: - fieldContext: resource fieldDataType: string name: k8s.persistentvolumeclaim.name - fieldContext: resource fieldDataType: string name: k8s.namespace.name name: B signal: metrics stepInterval: 60 type: builder_query - spec: expression: (1 - A/B) * 100 legend: '{{k8s.persistentvolumeclaim.name}} ({{k8s.namespace.name}})' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-storage matchType: at_least_once name: critical op: above target: 80 description: Disk utilization for a persistent volume is above 80% evaluation: kind: rolling spec: evalWindow: 30m frequency: 5m labels: severity: critical notificationSettings: groupBy: - k8s.namespace.name - k8s.persistentvolumeclaim.name renotify: alertStates: - firing enabled: true interval: 2h ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 metric_threshold_single: description: Fires when a pod consumes more than 80% of its requested CPU for the whole evaluation window. Uses `k8s.pod.cpu_request_utilization`. summary: Metric threshold single builder query value: alert: Pod CPU above 80% of request alertType: METRIC_BASED_ALERT annotations: description: Pod {{$k8s.pod.name}} CPU is at {{$value}} of request in {{$deployment.environment}}. summary: Pod CPU above {{$threshold}} of request condition: compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: k8s.pod.cpu_request_utilization spaceAggregation: max timeAggregation: avg filter: expression: k8s.deployment.name = 'api-service' groupBy: - fieldContext: resource fieldDataType: string name: k8s.pod.name - fieldContext: resource fieldDataType: string name: deployment.environment legend: '{{k8s.pod.name}} ({{deployment.environment}})' name: A signal: metrics stepInterval: 60 type: builder_query queryType: builder unit: percentunit selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-platform - pagerduty-oncall matchType: all_the_times name: critical op: above target: 0.8 description: CPU usage for api-service pods exceeds 80% of the requested CPU evaluation: kind: rolling spec: evalWindow: 15m frequency: 1m labels: severity: critical team: platform notificationSettings: groupBy: - k8s.pod.name - deployment.environment renotify: alertStates: - firing enabled: true interval: 4h ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 notification_settings: description: 'Demonstrates the full notificationSettings surface: `groupBy` merges alerts across labels to cut noise, `newGroupEvalDelay` gives newly-appearing series a grace period before firing, `renotify` re-alerts every 30m while firing OR while the alert is in nodata (missing data is treated as actionable), and `usePolicy: false` means channels come from the threshold entries rather than global routing policies. Set `usePolicy: true` to skip per-threshold channels and route via the org-level notification policy instead.' summary: Full notification settings (grouping, nodata renotify, grace period) value: alert: API 5xx error rate above 1% alertType: TRACES_BASED_ALERT annotations: description: '{{$service.name}} 5xx rate in {{$deployment.environment}} is {{$value}}%.' summary: API service error rate elevated condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name CONTAINS 'api' AND http.status_code >= 500 groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: resource fieldDataType: string name: deployment.environment name: A signal: traces stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name CONTAINS 'api' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: resource fieldDataType: string name: deployment.environment name: B signal: traces stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{service.name}} ({{deployment.environment}})' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-api-alerts - pagerduty-oncall matchType: at_least_once name: critical op: above target: 1 description: Noise-controlled 5xx error rate alert with renotify on gaps evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: team: platform notificationSettings: groupBy: - service.name - deployment.environment newGroupEvalDelay: 2m renotify: alertStates: - firing - nodata enabled: true interval: 30m usePolicy: false ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 tiered_thresholds: description: Two tiers (warning and critical) in a single rule, each with its own target, op, matchType, and channels so warnings and pages route to different receivers. `alertOnAbsent` + `absentFor` fires a no-data alert when the query returns no series for 15 consecutive evaluations. summary: Tiered thresholds with per-tier channels value: alert: Kafka consumer lag warn / critical alertType: METRIC_BASED_ALERT annotations: description: Consumer lag for {{$topic}} partition {{$partition}} is {{$value}}. summary: Kafka consumer lag condition: absentFor: 15 alertOnAbsent: true compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: kafka_log_end_offset spaceAggregation: max timeAggregation: max disabled: true filter: expression: topic != '__consumer_offsets' groupBy: - fieldContext: attribute fieldDataType: string name: topic - fieldContext: attribute fieldDataType: string name: partition name: A signal: metrics stepInterval: 60 type: builder_query - spec: aggregations: - metricName: kafka_consumer_committed_offset spaceAggregation: max timeAggregation: max disabled: true filter: expression: topic != '__consumer_offsets' groupBy: - fieldContext: attribute fieldDataType: string name: topic - fieldContext: attribute fieldDataType: string name: partition name: B signal: metrics stepInterval: 60 type: builder_query - spec: expression: A - B legend: '{{topic}}/{{partition}}' name: F1 type: builder_formula queryType: builder selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-kafka-info matchType: all_the_times name: warning op: above target: 50 - channels: - slack-kafka-alerts - pagerduty-kafka matchType: all_the_times name: critical op: above target: 200 description: Warn at lag ≥ 50 and page at ≥ 200, tiered via thresholds.spec. evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: team: data-platform notificationSettings: groupBy: - topic renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 traces_error_rate_formula: description: Two disabled trace count queries (A = error spans where hasError=true, B = total spans) combined via a builder_formula into a percentage. Mirrors the common request-error-rate dashboard shape. summary: Traces error rate error spans / total spans × 100 value: alert: Search-api error rate above 5% alertType: TRACES_BASED_ALERT annotations: description: Error rate on {{$service.name}} {{$http.route}} is {{$value}}% summary: Search-api error rate above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'search-api' AND hasError = true groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route name: A signal: traces stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'search-api' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route name: B signal: traces stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{service.name}} {{http.route}}' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-search - pagerduty-search matchType: at_least_once name: critical op: above target: 5 description: Request error rate for search-api, grouped by route evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: search notificationSettings: groupBy: - service.name - http.route renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 traces_threshold_latency: description: Builder query against the traces signal with p99(duration_nano). The series unit is ns (compositeQuery.unit), the target is in seconds (threshold.targetUnit) SigNoz converts before comparing. Canonical shape when series and target live in different units. summary: Traces threshold p99 latency (ns → s conversion) value: alert: Search API p99 latency above 5s alertType: TRACES_BASED_ALERT annotations: description: p99 latency for {{$service.name}} on {{$http.route}} crossed {{$threshold}}s. summary: Search-api latency degraded condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: p99(duration_nano) filter: expression: service.name = 'search-api' AND name = 'GET /api/v1/search' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route legend: '{{service.name}} {{http.route}}' name: A signal: traces stepInterval: 60 type: builder_query queryType: builder unit: ns selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-search matchType: at_least_once name: warning op: above target: 5 targetUnit: s description: p99 duration of the search endpoint exceeds 5s evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: warning team: search notificationSettings: groupBy: - service.name - http.route renotify: alertStates: - firing enabled: true interval: 30m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 schema: $ref: '#/components/schemas/RuletypesPostableRule' responses: '204': description: No Content '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - EDITOR - tokenizer: - EDITOR summary: Update alert rule tags: - rules /api/v2/rules/{id}/history/filter_keys: get: deprecated: false description: Returns distinct label keys from rule history entries for the selected range. operationId: GetRuleHistoryFilterKeys parameters: - in: query name: signal schema: $ref: '#/components/schemas/TelemetrytypesSignal' - in: query name: source schema: $ref: '#/components/schemas/TelemetrytypesSource' - in: query name: limit schema: type: integer - in: query name: startUnixMilli schema: format: int64 type: integer - in: query name: endUnixMilli schema: format: int64 type: integer - in: query name: fieldContext schema: $ref: '#/components/schemas/TelemetrytypesFieldContext' - in: query name: fieldDataType schema: $ref: '#/components/schemas/TelemetrytypesFieldDataType' - in: query name: metricName schema: type: string - in: query name: metricNamespace schema: type: string - in: query name: searchText schema: type: string - in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/TelemetrytypesGettableFieldKeys' status: type: string required: - status - data type: object description: OK '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - VIEWER - tokenizer: - VIEWER summary: Get rule history filter keys tags: - rules /api/v2/rules/{id}/history/filter_values: get: deprecated: false description: Returns distinct label values for a given key from rule history entries. operationId: GetRuleHistoryFilterValues parameters: - in: query name: signal schema: $ref: '#/components/schemas/TelemetrytypesSignal' - in: query name: source schema: $ref: '#/components/schemas/TelemetrytypesSource' - in: query name: limit schema: type: integer - in: query name: startUnixMilli schema: format: int64 type: integer - in: query name: endUnixMilli schema: format: int64 type: integer - in: query name: fieldContext schema: $ref: '#/components/schemas/TelemetrytypesFieldContext' - in: query name: fieldDataType schema: $ref: '#/components/schemas/TelemetrytypesFieldDataType' - in: query name: metricName schema: type: string - in: query name: metricNamespace schema: type: string - in: query name: searchText schema: type: string - in: query name: name schema: type: string - in: query name: existingQuery schema: type: string - in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/TelemetrytypesGettableFieldValues' status: type: string required: - status - data type: object description: OK '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - VIEWER - tokenizer: - VIEWER summary: Get rule history filter values tags: - rules /api/v2/rules/{id}/history/overall_status: get: deprecated: false description: Returns overall firing/inactive intervals for a rule in the selected time range. operationId: GetRuleHistoryOverallStatus parameters: - in: query name: start required: true schema: format: int64 type: integer - in: query name: end required: true schema: format: int64 type: integer - in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: properties: data: items: $ref: '#/components/schemas/RulestatehistorytypesGettableRuleStateWindow' nullable: true type: array status: type: string required: - status - data type: object description: OK '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - VIEWER - tokenizer: - VIEWER summary: Get rule overall status timeline tags: - rules /api/v2/rules/{id}/history/stats: get: deprecated: false description: Returns trigger and resolution statistics for a rule in the selected time range. operationId: GetRuleHistoryStats parameters: - in: query name: start required: true schema: format: int64 type: integer - in: query name: end required: true schema: format: int64 type: integer - in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/RulestatehistorytypesGettableRuleStateHistoryStats' status: type: string required: - status - data type: object description: OK '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - VIEWER - tokenizer: - VIEWER summary: Get rule history stats tags: - rules /api/v2/rules/{id}/history/timeline: get: deprecated: false description: Returns paginated timeline entries for rule state transitions. operationId: GetRuleHistoryTimeline parameters: - in: query name: start required: true schema: format: int64 type: integer - in: query name: end required: true schema: format: int64 type: integer - in: query name: state schema: $ref: '#/components/schemas/RuletypesAlertState' - in: query name: filterExpression schema: type: string - in: query name: limit schema: format: int64 type: integer - in: query name: order schema: $ref: '#/components/schemas/Querybuildertypesv5OrderDirection' - in: query name: cursor schema: type: string - in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/RulestatehistorytypesGettableRuleStateTimeline' status: type: string required: - status - data type: object description: OK '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - VIEWER - tokenizer: - VIEWER summary: Get rule history timeline tags: - rules /api/v2/rules/{id}/history/top_contributors: get: deprecated: false description: Returns top label combinations contributing to rule firing in the selected time range. operationId: GetRuleHistoryTopContributors parameters: - in: query name: start required: true schema: format: int64 type: integer - in: query name: end required: true schema: format: int64 type: integer - in: path name: id required: true schema: type: string responses: '200': content: application/json: schema: properties: data: items: $ref: '#/components/schemas/RulestatehistorytypesGettableRuleStateHistoryContributor' nullable: true type: array status: type: string required: - status - data type: object description: OK '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - VIEWER - tokenizer: - VIEWER summary: Get top contributors to rule firing tags: - rules /api/v2/rules/test: post: deprecated: false description: This endpoint fires a test notification for the given rule definition operationId: TestRule requestBody: content: application/json: examples: logs_error_rate_formula: description: Two disabled log count queries (A = errors, B = total) combined via a builder_formula into a percentage. Classic service-level error-rate alert pattern for log-based signals. summary: Logs error rate error count / total count × 100 value: alert: Payments-api error log rate above 1% alertType: LOGS_BASED_ALERT annotations: description: Error log rate in {{$deployment.environment}} is {{$value}}% summary: Payments-api error rate above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'payments-api' AND severity_text IN ['ERROR', 'FATAL'] groupBy: - fieldContext: resource fieldDataType: string name: deployment.environment name: A signal: logs stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'payments-api' groupBy: - fieldContext: resource fieldDataType: string name: deployment.environment name: B signal: logs stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{deployment.environment}}' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-payments matchType: at_least_once name: critical op: above target: 1 description: Error log ratio as a percentage of total logs for payments-api evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: payments notificationSettings: groupBy: - deployment.environment renotify: alertStates: - firing enabled: true interval: 30m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 logs_threshold: description: Counts matching log records (ERROR severity + body contains) over a rolling window. Fires at least once per evaluation when the count exceeds zero. summary: Logs threshold count() over filter value: alert: Payments service panic logs alertType: LOGS_BASED_ALERT annotations: description: '{{$k8s.pod.name}} emitted {{$value}} panic log(s) in {{$deployment.environment}}.' summary: Payments service panic condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() filter: expression: service.name = 'payments-api' AND severity_text = 'ERROR' AND body CONTAINS 'panic' groupBy: - fieldContext: resource fieldDataType: string name: k8s.pod.name - fieldContext: resource fieldDataType: string name: deployment.environment legend: '{{k8s.pod.name}} ({{deployment.environment}})' name: A signal: logs stepInterval: 60 type: builder_query queryType: builder selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-payments - pagerduty-payments matchType: at_least_once name: critical op: above target: 0 description: Any panic log line emitted by the payments service evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: payments notificationSettings: groupBy: - k8s.pod.name - deployment.environment renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 metric_anomaly: description: Anomaly rules are not yet supported under schemaVersion v2alpha1, so this example uses the v1 shape. Wraps a builder query in the `anomaly` function with daily seasonality SigNoz compares each point against the forecast for that time of day. Fires when the anomaly score stays below the threshold for the entire window; `requireMinPoints` guards against noisy intervals. summary: Metric anomaly rule (v1 only) value: alert: Anomalous drop in ingested spans alertType: METRIC_BASED_ALERT annotations: description: Ingestion rate for tenant {{$tenant_id}} is anomalously low (z-score {{$value}}). summary: Span ingestion anomaly condition: algorithm: standard compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: otelcol_receiver_accepted_spans spaceAggregation: sum timeAggregation: rate filter: expression: tenant_tier = 'premium' functions: - args: - name: z_score_threshold value: 2 name: anomaly groupBy: - fieldContext: attribute fieldDataType: string name: tenant_id legend: '{{tenant_id}}' name: A signal: metrics stepInterval: 21600 type: builder_query queryType: builder matchType: all_the_times op: below requireMinPoints: true requiredNumPoints: 3 seasonality: daily selectedQueryName: A target: 2 description: Detect an abrupt drop in span ingestion using a z-score anomaly function evalWindow: 24h frequency: 3h labels: severity: warning preferredChannels: - slack-ingestion ruleType: anomaly_rule version: v5 metric_promql: description: PromQL expression instead of the builder. Dotted OTEL resource attributes are quoted ("deployment.environment"). Useful for queries that combine series with group_right or other Prom operators. summary: Metric threshold PromQL rule value: alert: Kafka consumer group lag above 1000 alertType: METRIC_BASED_ALERT annotations: description: Consumer group {{$group}} is {{$value}} messages behind on {{$topic}}/{{$partition}}. summary: Kafka consumer lag high condition: compositeQuery: panelType: graph queries: - spec: legend: '{{topic}}/{{partition}} ({{group}})' name: A query: (max by(topic, partition, "deployment.environment")(kafka_log_end_offset) - on(topic, partition, "deployment.environment") group_right max by(group, topic, partition, "deployment.environment")(kafka_consumer_committed_offset)) > 0 type: promql queryType: promql selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-data-platform - pagerduty-data matchType: all_the_times name: critical op: above target: 1000 description: Consumer group lag computed via PromQL evaluation: kind: rolling spec: evalWindow: 10m frequency: 1m labels: severity: critical notificationSettings: groupBy: - group - topic renotify: alertStates: - firing enabled: true interval: 1h ruleType: promql_rule schemaVersion: v2alpha1 version: v5 metric_threshold_formula: description: Computes disk utilization as (1 - available/capacity) * 100 by combining two disabled base queries with a builder_formula. The formula emits 0–100, so compositeQuery.unit is set to "percent" and the target is a bare number. summary: Metric threshold multi-query formula value: alert: PersistentVolume above 80% utilization alertType: METRIC_BASED_ALERT annotations: description: Volume {{$k8s.persistentvolumeclaim.name}} in {{$k8s.namespace.name}} is {{$value}}% full. summary: Disk utilization above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: k8s.volume.available spaceAggregation: max timeAggregation: max disabled: true filter: expression: k8s.volume.type = 'persistentVolumeClaim' groupBy: - fieldContext: resource fieldDataType: string name: k8s.persistentvolumeclaim.name - fieldContext: resource fieldDataType: string name: k8s.namespace.name name: A signal: metrics stepInterval: 60 type: builder_query - spec: aggregations: - metricName: k8s.volume.capacity spaceAggregation: max timeAggregation: max disabled: true filter: expression: k8s.volume.type = 'persistentVolumeClaim' groupBy: - fieldContext: resource fieldDataType: string name: k8s.persistentvolumeclaim.name - fieldContext: resource fieldDataType: string name: k8s.namespace.name name: B signal: metrics stepInterval: 60 type: builder_query - spec: expression: (1 - A/B) * 100 legend: '{{k8s.persistentvolumeclaim.name}} ({{k8s.namespace.name}})' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-storage matchType: at_least_once name: critical op: above target: 80 description: Disk utilization for a persistent volume is above 80% evaluation: kind: rolling spec: evalWindow: 30m frequency: 5m labels: severity: critical notificationSettings: groupBy: - k8s.namespace.name - k8s.persistentvolumeclaim.name renotify: alertStates: - firing enabled: true interval: 2h ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 metric_threshold_single: description: Fires when a pod consumes more than 80% of its requested CPU for the whole evaluation window. Uses `k8s.pod.cpu_request_utilization`. summary: Metric threshold single builder query value: alert: Pod CPU above 80% of request alertType: METRIC_BASED_ALERT annotations: description: Pod {{$k8s.pod.name}} CPU is at {{$value}} of request in {{$deployment.environment}}. summary: Pod CPU above {{$threshold}} of request condition: compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: k8s.pod.cpu_request_utilization spaceAggregation: max timeAggregation: avg filter: expression: k8s.deployment.name = 'api-service' groupBy: - fieldContext: resource fieldDataType: string name: k8s.pod.name - fieldContext: resource fieldDataType: string name: deployment.environment legend: '{{k8s.pod.name}} ({{deployment.environment}})' name: A signal: metrics stepInterval: 60 type: builder_query queryType: builder unit: percentunit selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-platform - pagerduty-oncall matchType: all_the_times name: critical op: above target: 0.8 description: CPU usage for api-service pods exceeds 80% of the requested CPU evaluation: kind: rolling spec: evalWindow: 15m frequency: 1m labels: severity: critical team: platform notificationSettings: groupBy: - k8s.pod.name - deployment.environment renotify: alertStates: - firing enabled: true interval: 4h ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 notification_settings: description: 'Demonstrates the full notificationSettings surface: `groupBy` merges alerts across labels to cut noise, `newGroupEvalDelay` gives newly-appearing series a grace period before firing, `renotify` re-alerts every 30m while firing OR while the alert is in nodata (missing data is treated as actionable), and `usePolicy: false` means channels come from the threshold entries rather than global routing policies. Set `usePolicy: true` to skip per-threshold channels and route via the org-level notification policy instead.' summary: Full notification settings (grouping, nodata renotify, grace period) value: alert: API 5xx error rate above 1% alertType: TRACES_BASED_ALERT annotations: description: '{{$service.name}} 5xx rate in {{$deployment.environment}} is {{$value}}%.' summary: API service error rate elevated condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name CONTAINS 'api' AND http.status_code >= 500 groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: resource fieldDataType: string name: deployment.environment name: A signal: traces stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name CONTAINS 'api' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: resource fieldDataType: string name: deployment.environment name: B signal: traces stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{service.name}} ({{deployment.environment}})' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-api-alerts - pagerduty-oncall matchType: at_least_once name: critical op: above target: 1 description: Noise-controlled 5xx error rate alert with renotify on gaps evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: team: platform notificationSettings: groupBy: - service.name - deployment.environment newGroupEvalDelay: 2m renotify: alertStates: - firing - nodata enabled: true interval: 30m usePolicy: false ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 tiered_thresholds: description: Two tiers (warning and critical) in a single rule, each with its own target, op, matchType, and channels so warnings and pages route to different receivers. `alertOnAbsent` + `absentFor` fires a no-data alert when the query returns no series for 15 consecutive evaluations. summary: Tiered thresholds with per-tier channels value: alert: Kafka consumer lag warn / critical alertType: METRIC_BASED_ALERT annotations: description: Consumer lag for {{$topic}} partition {{$partition}} is {{$value}}. summary: Kafka consumer lag condition: absentFor: 15 alertOnAbsent: true compositeQuery: panelType: graph queries: - spec: aggregations: - metricName: kafka_log_end_offset spaceAggregation: max timeAggregation: max disabled: true filter: expression: topic != '__consumer_offsets' groupBy: - fieldContext: attribute fieldDataType: string name: topic - fieldContext: attribute fieldDataType: string name: partition name: A signal: metrics stepInterval: 60 type: builder_query - spec: aggregations: - metricName: kafka_consumer_committed_offset spaceAggregation: max timeAggregation: max disabled: true filter: expression: topic != '__consumer_offsets' groupBy: - fieldContext: attribute fieldDataType: string name: topic - fieldContext: attribute fieldDataType: string name: partition name: B signal: metrics stepInterval: 60 type: builder_query - spec: expression: A - B legend: '{{topic}}/{{partition}}' name: F1 type: builder_formula queryType: builder selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-kafka-info matchType: all_the_times name: warning op: above target: 50 - channels: - slack-kafka-alerts - pagerduty-kafka matchType: all_the_times name: critical op: above target: 200 description: Warn at lag ≥ 50 and page at ≥ 200, tiered via thresholds.spec. evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: team: data-platform notificationSettings: groupBy: - topic renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 traces_error_rate_formula: description: Two disabled trace count queries (A = error spans where hasError=true, B = total spans) combined via a builder_formula into a percentage. Mirrors the common request-error-rate dashboard shape. summary: Traces error rate error spans / total spans × 100 value: alert: Search-api error rate above 5% alertType: TRACES_BASED_ALERT annotations: description: Error rate on {{$service.name}} {{$http.route}} is {{$value}}% summary: Search-api error rate above {{$threshold}}% condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'search-api' AND hasError = true groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route name: A signal: traces stepInterval: 60 type: builder_query - spec: aggregations: - expression: count() disabled: true filter: expression: service.name = 'search-api' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route name: B signal: traces stepInterval: 60 type: builder_query - spec: expression: (A / B) * 100 legend: '{{service.name}} {{http.route}}' name: F1 type: builder_formula queryType: builder unit: percent selectedQueryName: F1 thresholds: kind: basic spec: - channels: - slack-search - pagerduty-search matchType: at_least_once name: critical op: above target: 5 description: Request error rate for search-api, grouped by route evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: critical team: search notificationSettings: groupBy: - service.name - http.route renotify: alertStates: - firing enabled: true interval: 15m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 traces_threshold_latency: description: Builder query against the traces signal with p99(duration_nano). The series unit is ns (compositeQuery.unit), the target is in seconds (threshold.targetUnit) SigNoz converts before comparing. Canonical shape when series and target live in different units. summary: Traces threshold p99 latency (ns → s conversion) value: alert: Search API p99 latency above 5s alertType: TRACES_BASED_ALERT annotations: description: p99 latency for {{$service.name}} on {{$http.route}} crossed {{$threshold}}s. summary: Search-api latency degraded condition: compositeQuery: panelType: graph queries: - spec: aggregations: - expression: p99(duration_nano) filter: expression: service.name = 'search-api' AND name = 'GET /api/v1/search' groupBy: - fieldContext: resource fieldDataType: string name: service.name - fieldContext: attribute fieldDataType: string name: http.route legend: '{{service.name}} {{http.route}}' name: A signal: traces stepInterval: 60 type: builder_query queryType: builder unit: ns selectedQueryName: A thresholds: kind: basic spec: - channels: - slack-search matchType: at_least_once name: warning op: above target: 5 targetUnit: s description: p99 duration of the search endpoint exceeds 5s evaluation: kind: rolling spec: evalWindow: 5m frequency: 1m labels: severity: warning team: search notificationSettings: groupBy: - service.name - http.route renotify: alertStates: - firing enabled: true interval: 30m ruleType: threshold_rule schemaVersion: v2alpha1 version: v5 schema: $ref: '#/components/schemas/RuletypesPostableRule' responses: '200': content: application/json: schema: properties: data: $ref: '#/components/schemas/RuletypesGettableTestRule' status: type: string required: - status - data type: object description: OK '400': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Forbidden '500': content: application/json: schema: $ref: '#/components/schemas/RenderErrorResponse' description: Internal Server Error security: - api_key: - EDITOR - tokenizer: - EDITOR summary: Test alert rule tags: - rules components: schemas: Querybuildertypesv5FunctionName: enum: - cutoffmin - cutoffmax - clampmin - clampmax - absolute - runningdiff - log2 - log10 - cumulativesum - ewma3 - ewma5 - ewma7 - median3 - median5 - median7 - timeshift - anomaly - fillzero type: string MetrictypesSpaceAggregation: enum: - sum - avg - min - max - count - p50 - p75 - p90 - p95 - p99 type: string Querybuildertypesv5Label: properties: key: $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey' value: {} type: object MetrictypesComparisonSpaceAggregationParam: properties: operator: type: string threshold: format: double type: number required: - operator - threshold type: object Querybuildertypesv5QueryBuilderQueryGithubComSigNozSignozPkgTypesQuerybuildertypesQuerybuildertypesv5TraceAggregation: properties: aggregations: items: $ref: '#/components/schemas/Querybuildertypesv5TraceAggregation' type: array cursor: type: string disabled: type: boolean filter: $ref: '#/components/schemas/Querybuildertypesv5Filter' functions: items: $ref: '#/components/schemas/Querybuildertypesv5Function' type: array groupBy: items: $ref: '#/components/schemas/Querybuildertypesv5GroupByKey' type: array having: $ref: '#/components/schemas/Querybuildertypesv5Having' legend: type: string limit: type: integer limitBy: $ref: '#/components/schemas/Querybuildertypesv5LimitBy' name: type: string offset: type: integer order: items: $ref: '#/components/schemas/Querybuildertypesv5OrderBy' type: array secondaryAggregations: items: $ref: '#/components/schemas/Querybuildertypesv5SecondaryAggregation' type: array selectFields: items: $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey' type: array signal: $ref: '#/components/schemas/TelemetrytypesSignal' source: $ref: '#/components/schemas/TelemetrytypesSource' stepInterval: $ref: '#/components/schemas/Querybuildertypesv5Step' type: object RuletypesEvaluationRolling: properties: kind: $ref: '#/components/schemas/RuletypesEvaluationKind' spec: $ref: '#/components/schemas/RuletypesRollingWindow' type: object Querybuildertypesv5QueryEnvelopeClickHouseSQL: properties: spec: $ref: '#/components/schemas/Querybuildertypesv5ClickHouseQuery' type: $ref: '#/components/schemas/Querybuildertypesv5QueryType' type: object Querybuildertypesv5QueryEnvelopeFormula: properties: spec: $ref: '#/components/schemas/Querybuildertypesv5QueryBuilderFormula' type: $ref: '#/components/schemas/Querybuildertypesv5QueryType' type: object TelemetrytypesSource: enum: - meter type: string RuletypesRuleThresholdData: oneOf: - $ref: '#/components/schemas/RuletypesThresholdBasic' properties: kind: $ref: '#/components/schemas/RuletypesThresholdKind' spec: {} required: - kind - spec type: object Querybuildertypesv5Filter: properties: expression: type: string type: object Querybuildertypesv5QueryEnvelopeTraceOperator: properties: spec: $ref: '#/components/schemas/Querybuildertypesv5QueryBuilderTraceOperator' type: $ref: '#/components/schemas/Querybuildertypesv5QueryType' type: object RuletypesAlertCompositeQuery: properties: panelType: $ref: '#/components/schemas/RuletypesPanelType' queries: items: $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelope' nullable: true type: array queryType: $ref: '#/components/schemas/RuletypesQueryType' unit: type: string required: - queries - panelType - queryType type: object RuletypesCumulativeSchedule: properties: day: nullable: true type: integer hour: nullable: true type: integer minute: nullable: true type: integer type: $ref: '#/components/schemas/RuletypesScheduleType' weekday: nullable: true type: integer required: - type type: object MetrictypesTemporality: enum: - delta - cumulative - unspecified type: string RulestatehistorytypesGettableRuleStateHistoryContributor: properties: count: minimum: 0 type: integer fingerprint: minimum: 0 type: integer labels: items: $ref: '#/components/schemas/Querybuildertypesv5Label' nullable: true type: array relatedLogsLink: type: string relatedTracesLink: type: string required: - fingerprint - labels - count type: object RuletypesRule: properties: alert: type: string alertType: $ref: '#/components/schemas/RuletypesAlertType' annotations: additionalProperties: type: string type: object condition: $ref: '#/components/schemas/RuletypesRuleCondition' createdAt: format: date-time type: string createdBy: type: string description: type: string disabled: type: boolean evalWindow: type: string evaluation: $ref: '#/components/schemas/RuletypesEvaluationEnvelope' frequency: type: string id: type: string labels: additionalProperties: type: string type: object notificationSettings: $ref: '#/components/schemas/RuletypesNotificationSettings' preferredChannels: items: type: string type: array ruleType: $ref: '#/components/schemas/RuletypesRuleType' schemaVersion: type: string source: type: string state: $ref: '#/components/schemas/RuletypesAlertState' updatedAt: format: date-time type: string updatedBy: type: string version: type: string required: - id - state - alert - alertType - ruleType - condition type: object Querybuildertypesv5QueryEnvelopePromQL: properties: spec: $ref: '#/components/schemas/Querybuildertypesv5PromQuery' type: $ref: '#/components/schemas/Querybuildertypesv5QueryType' type: object RuletypesEvaluationKind: enum: - rolling - cumulative type: string Querybuildertypesv5QueryBuilderFormula: properties: disabled: type: boolean expression: type: string functions: items: $ref: '#/components/schemas/Querybuildertypesv5Function' type: array having: $ref: '#/components/schemas/Querybuildertypesv5Having' legend: type: string limit: type: integer name: type: string order: items: $ref: '#/components/schemas/Querybuildertypesv5OrderBy' type: array type: object Querybuildertypesv5TraceAggregation: properties: alias: type: string expression: type: string type: object Querybuildertypesv5Bucket: properties: step: format: double type: number type: object RuletypesCumulativeWindow: properties: frequency: type: string schedule: $ref: '#/components/schemas/RuletypesCumulativeSchedule' timezone: type: string required: - schedule - frequency - timezone type: object Querybuildertypesv5QueryBuilderTraceOperator: properties: aggregations: items: $ref: '#/components/schemas/Querybuildertypesv5TraceAggregation' type: array cursor: type: string disabled: type: boolean expression: type: string filter: $ref: '#/components/schemas/Querybuildertypesv5Filter' functions: items: $ref: '#/components/schemas/Querybuildertypesv5Function' type: array groupBy: items: $ref: '#/components/schemas/Querybuildertypesv5GroupByKey' type: array having: $ref: '#/components/schemas/Querybuildertypesv5Having' legend: type: string limit: type: integer name: type: string offset: type: integer order: items: $ref: '#/components/schemas/Querybuildertypesv5OrderBy' type: array returnSpansFrom: type: string selectFields: items: $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey' type: array stepInterval: $ref: '#/components/schemas/Querybuildertypesv5Step' type: object RuletypesThresholdKind: enum: - basic type: string RuletypesCompareOperator: enum: - above - below - equal - not_equal - outside_bounds type: string RuletypesMatchType: enum: - at_least_once - all_the_times - on_average - in_total - last type: string Querybuildertypesv5ReduceTo: enum: - sum - count - avg - min - max - last - median type: string Querybuildertypesv5FunctionArg: properties: name: type: string value: {} type: object ErrorsResponseerroradditional: properties: message: type: string type: object TelemetrytypesFieldDataType: enum: - string - bool - float64 - int64 - number type: string RuletypesSeasonality: enum: - hourly - daily - weekly type: string TelemetrytypesTelemetryFieldKey: properties: description: type: string fieldContext: $ref: '#/components/schemas/TelemetrytypesFieldContext' fieldDataType: $ref: '#/components/schemas/TelemetrytypesFieldDataType' name: type: string signal: $ref: '#/components/schemas/TelemetrytypesSignal' unit: type: string required: - name type: object Querybuildertypesv5TimeSeriesValue: properties: bucket: $ref: '#/components/schemas/Querybuildertypesv5Bucket' partial: type: boolean timestamp: format: int64 type: integer value: format: double type: number values: items: format: double type: number type: array type: object TelemetrytypesFieldContext: enum: - metric - log - span - resource - attribute - body type: string Querybuildertypesv5TimeSeries: properties: labels: items: $ref: '#/components/schemas/Querybuildertypesv5Label' type: array values: items: $ref: '#/components/schemas/Querybuildertypesv5TimeSeriesValue' nullable: true type: array type: object RuletypesNotificationSettings: properties: groupBy: items: type: string type: array newGroupEvalDelay: type: string renotify: $ref: '#/components/schemas/RuletypesRenotify' usePolicy: type: boolean type: object Querybuildertypesv5LogAggregation: properties: alias: type: string expression: type: string type: object Querybuildertypesv5QueryBuilderQueryGithubComSigNozSignozPkgTypesQuerybuildertypesQuerybuildertypesv5LogAggregation: properties: aggregations: items: $ref: '#/components/schemas/Querybuildertypesv5LogAggregation' type: array cursor: type: string disabled: type: boolean filter: $ref: '#/components/schemas/Querybuildertypesv5Filter' functions: items: $ref: '#/components/schemas/Querybuildertypesv5Function' type: array groupBy: items: $ref: '#/components/schemas/Querybuildertypesv5GroupByKey' type: array having: $ref: '#/components/schemas/Querybuildertypesv5Having' legend: type: string limit: type: integer limitBy: $ref: '#/components/schemas/Querybuildertypesv5LimitBy' name: type: string offset: type: integer order: items: $ref: '#/components/schemas/Querybuildertypesv5OrderBy' type: array secondaryAggregations: items: $ref: '#/components/schemas/Querybuildertypesv5SecondaryAggregation' type: array selectFields: items: $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey' type: array signal: $ref: '#/components/schemas/TelemetrytypesSignal' source: $ref: '#/components/schemas/TelemetrytypesSource' stepInterval: $ref: '#/components/schemas/Querybuildertypesv5Step' type: object RuletypesBasicRuleThreshold: properties: channels: items: type: string nullable: true type: array matchType: $ref: '#/components/schemas/RuletypesMatchType' name: type: string op: $ref: '#/components/schemas/RuletypesCompareOperator' recoveryTarget: nullable: true type: number target: nullable: true type: number targetUnit: type: string required: - name - target - matchType - op type: object RuletypesQueryType: enum: - builder - clickhouse_sql - promql type: string RuletypesPostableRule: properties: alert: type: string alertType: $ref: '#/components/schemas/RuletypesAlertType' annotations: additionalProperties: type: string type: object condition: $ref: '#/components/schemas/RuletypesRuleCondition' description: type: string disabled: type: boolean evalWindow: type: string evaluation: $ref: '#/components/schemas/RuletypesEvaluationEnvelope' frequency: type: string labels: additionalProperties: type: string type: object notificationSettings: $ref: '#/components/schemas/RuletypesNotificationSettings' preferredChannels: items: type: string type: array ruleType: $ref: '#/components/schemas/RuletypesRuleType' schemaVersion: type: string source: type: string version: type: string required: - alert - alertType - ruleType - condition type: object RuletypesGettableTestRule: properties: alertCount: type: integer message: type: string type: object Querybuildertypesv5QueryEnvelopeBuilderTrace: properties: spec: $ref: '#/components/schemas/Querybuildertypesv5QueryBuilderQueryGithubComSigNozSignozPkgTypesQuerybuildertypesQuerybuildertypesv5TraceAggregation' type: $ref: '#/components/schemas/Querybuildertypesv5QueryType' type: object RulestatehistorytypesGettableRuleStateHistoryStats: properties: currentAvgResolutionTime: format: double type: number currentAvgResolutionTimeSeries: $ref: '#/components/schemas/Querybuildertypesv5TimeSeries' currentTriggersSeries: $ref: '#/components/schemas/Querybuildertypesv5TimeSeries' pastAvgResolutionTime: format: double type: number pastAvgResolutionTimeSeries: $ref: '#/components/schemas/Querybuildertypesv5TimeSeries' pastTriggersSeries: $ref: '#/components/schemas/Querybuildertypesv5TimeSeries' totalCurrentTriggers: minimum: 0 type: integer totalPastTriggers: minimum: 0 type: integer required: - totalCurrentTriggers - totalPastTriggers - currentTriggersSeries - pastTriggersSeries - currentAvgResolutionTime - pastAvgResolutionTime - currentAvgResolutionTimeSeries - pastAvgResolutionTimeSeries type: object Querybuildertypesv5QueryBuilderQueryGithubComSigNozSignozPkgTypesQuerybuildertypesQuerybuildertypesv5MetricAggregation: properties: aggregations: items: $ref: '#/components/schemas/Querybuildertypesv5MetricAggregation' type: array cursor: type: string disabled: type: boolean filter: $ref: '#/components/schemas/Querybuildertypesv5Filter' functions: items: $ref: '#/components/schemas/Querybuildertypesv5Function' type: array groupBy: items: $ref: '#/components/schemas/Querybuildertypesv5GroupByKey' type: array having: $ref: '#/components/schemas/Querybuildertypesv5Having' legend: type: string limit: type: integer limitBy: $ref: '#/components/schemas/Querybuildertypesv5LimitBy' name: type: string offset: type: integer order: items: $ref: '#/components/schemas/Querybuildertypesv5OrderBy' type: array secondaryAggregations: items: $ref: '#/components/schemas/Querybuildertypesv5SecondaryAggregation' type: array selectFields: items: $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey' type: array signal: $ref: '#/components/schemas/TelemetrytypesSignal' source: $ref: '#/components/schemas/TelemetrytypesSource' stepInterval: $ref: '#/components/schemas/Querybuildertypesv5Step' type: object RuletypesThresholdBasic: properties: kind: $ref: '#/components/schemas/RuletypesThresholdKind' spec: $ref: '#/components/schemas/RuletypesBasicRuleThresholds' type: object Querybuildertypesv5OrderBy: properties: direction: $ref: '#/components/schemas/Querybuildertypesv5OrderDirection' key: $ref: '#/components/schemas/Querybuildertypesv5OrderByKey' type: object RenderErrorResponse: properties: error: $ref: '#/components/schemas/ErrorsJSON' status: type: string required: - status - error type: object RulestatehistorytypesGettableRuleStateTimeline: properties: items: items: $ref: '#/components/schemas/RulestatehistorytypesGettableRuleStateHistory' nullable: true type: array nextCursor: type: string total: minimum: 0 type: integer required: - items - total type: object RuletypesRuleCondition: properties: absentFor: minimum: 0 type: integer alertOnAbsent: type: boolean algorithm: type: string compositeQuery: $ref: '#/components/schemas/RuletypesAlertCompositeQuery' matchType: $ref: '#/components/schemas/RuletypesMatchType' op: $ref: '#/components/schemas/RuletypesCompareOperator' requireMinPoints: type: boolean requiredNumPoints: type: integer seasonality: $ref: '#/components/schemas/RuletypesSeasonality' selectedQueryName: type: string target: nullable: true type: number targetUnit: type: string thresholds: $ref: '#/components/schemas/RuletypesRuleThresholdData' required: - compositeQuery type: object Querybuildertypesv5Function: properties: args: items: $ref: '#/components/schemas/Querybuildertypesv5FunctionArg' type: array name: $ref: '#/components/schemas/Querybuildertypesv5FunctionName' type: object TelemetrytypesGettableFieldKeys: properties: complete: type: boolean keys: additionalProperties: items: $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey' type: array nullable: true type: object required: - keys - complete type: object Querybuildertypesv5OrderByKey: properties: description: type: string fieldContext: $ref: '#/components/schemas/TelemetrytypesFieldContext' fieldDataType: $ref: '#/components/schemas/TelemetrytypesFieldDataType' name: type: string signal: $ref: '#/components/schemas/TelemetrytypesSignal' unit: type: string required: - name type: object MetrictypesTimeAggregation: enum: - latest - sum - avg - min - max - count - count_distinct - rate - increase type: string RuletypesRenotify: properties: alertStates: items: $ref: '#/components/schemas/RuletypesAlertState' type: array enabled: type: boolean interval: type: string type: object RuletypesEvaluationEnvelope: oneOf: - $ref: '#/components/schemas/RuletypesEvaluationRolling' - $ref: '#/components/schemas/RuletypesEvaluationCumulative' properties: kind: $ref: '#/components/schemas/RuletypesEvaluationKind' spec: {} required: - kind - spec type: object RuletypesScheduleType: enum: - hourly - daily - weekly - monthly type: string TelemetrytypesSignal: enum: - traces - logs - metrics type: string Querybuildertypesv5PromQuery: properties: disabled: type: boolean legend: type: string name: type: string query: type: string stats: type: boolean step: $ref: '#/components/schemas/Querybuildertypesv5Step' type: object Querybuildertypesv5LimitBy: properties: keys: items: type: string nullable: true type: array value: type: string type: object Querybuildertypesv5Having: properties: expression: type: string type: object RuletypesPanelType: enum: - value - table - graph type: string RuletypesAlertState: enum: - inactive - pending - recovering - firing - nodata - disabled type: string Querybuildertypesv5QueryEnvelopeBuilderLog: properties: spec: $ref: '#/components/schemas/Querybuildertypesv5QueryBuilderQueryGithubComSigNozSignozPkgTypesQuerybuildertypesQuerybuildertypesv5LogAggregation' type: $ref: '#/components/schemas/Querybuildertypesv5QueryType' type: object RuletypesAlertType: enum: - METRIC_BASED_ALERT - TRACES_BASED_ALERT - LOGS_BASED_ALERT - EXCEPTIONS_BASED_ALERT type: string RuletypesRollingWindow: properties: evalWindow: type: string frequency: type: string required: - evalWindow - frequency type: object RuletypesBasicRuleThresholds: items: $ref: '#/components/schemas/RuletypesBasicRuleThreshold' nullable: true type: array TelemetrytypesGettableFieldValues: properties: complete: type: boolean values: $ref: '#/components/schemas/TelemetrytypesTelemetryFieldValues' required: - values - complete type: object Querybuildertypesv5QueryEnvelope: oneOf: - $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelopeBuilderTrace' - $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelopeBuilderLog' - $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelopeBuilderMetric' - $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelopeFormula' - $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelopeTraceOperator' - $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelopePromQL' - $ref: '#/components/schemas/Querybuildertypesv5QueryEnvelopeClickHouseSQL' properties: spec: {} type: $ref: '#/components/schemas/Querybuildertypesv5QueryType' type: object Querybuildertypesv5QueryType: enum: - builder_query - builder_formula - builder_trace_operator - clickhouse_sql - promql type: string Querybuildertypesv5GroupByKey: properties: description: type: string fieldContext: $ref: '#/components/schemas/TelemetrytypesFieldContext' fieldDataType: $ref: '#/components/schemas/TelemetrytypesFieldDataType' name: type: string signal: $ref: '#/components/schemas/TelemetrytypesSignal' unit: type: string required: - name type: object Querybuildertypesv5SecondaryAggregation: properties: alias: type: string expression: type: string groupBy: items: $ref: '#/components/schemas/Querybuildertypesv5GroupByKey' type: array limit: type: integer limitBy: $ref: '#/components/schemas/Querybuildertypesv5LimitBy' order: items: $ref: '#/components/schemas/Querybuildertypesv5OrderBy' type: array stepInterval: $ref: '#/components/schemas/Querybuildertypesv5Step' type: object Querybuildertypesv5QueryEnvelopeBuilderMetric: properties: spec: $ref: '#/components/schemas/Querybuildertypesv5QueryBuilderQueryGithubComSigNozSignozPkgTypesQuerybuildertypesQuerybuildertypesv5MetricAggregation' type: $ref: '#/components/schemas/Querybuildertypesv5QueryType' type: object Querybuildertypesv5MetricAggregation: properties: comparisonSpaceAggregationParam: $ref: '#/components/schemas/MetrictypesComparisonSpaceAggregationParam' metricName: type: string reduceTo: $ref: '#/components/schemas/Querybuildertypesv5ReduceTo' spaceAggregation: $ref: '#/components/schemas/MetrictypesSpaceAggregation' temporality: $ref: '#/components/schemas/MetrictypesTemporality' timeAggregation: $ref: '#/components/schemas/MetrictypesTimeAggregation' type: object RuletypesRuleType: enum: - threshold_rule - promql_rule - anomaly_rule type: string Querybuildertypesv5ClickHouseQuery: properties: disabled: type: boolean legend: type: string name: type: string query: type: string type: object RuletypesEvaluationCumulative: properties: kind: $ref: '#/components/schemas/RuletypesEvaluationKind' spec: $ref: '#/components/schemas/RuletypesCumulativeWindow' type: object RulestatehistorytypesGettableRuleStateWindow: properties: end: format: int64 type: integer start: format: int64 type: integer state: $ref: '#/components/schemas/RuletypesAlertState' required: - state - start - end type: object ErrorsJSON: properties: code: type: string errors: items: $ref: '#/components/schemas/ErrorsResponseerroradditional' type: array message: type: string url: type: string required: - code - message type: object TelemetrytypesTelemetryFieldValues: properties: boolValues: items: type: boolean type: array numberValues: items: format: double type: number type: array relatedValues: items: type: string type: array stringValues: items: type: string type: array type: object Querybuildertypesv5OrderDirection: enum: - asc - desc type: string RulestatehistorytypesGettableRuleStateHistory: properties: fingerprint: minimum: 0 type: integer labels: items: $ref: '#/components/schemas/Querybuildertypesv5Label' nullable: true type: array overallState: $ref: '#/components/schemas/RuletypesAlertState' overallStateChanged: type: boolean ruleId: type: string ruleName: type: string state: $ref: '#/components/schemas/RuletypesAlertState' stateChanged: type: boolean unixMilli: format: int64 type: integer value: format: double type: number required: - ruleId - ruleName - overallState - overallStateChanged - state - stateChanged - unixMilli - labels - fingerprint - value type: object Querybuildertypesv5Step: description: Step interval. Accepts a Go duration string (e.g., "60s", "1m", "1h") or a number representing seconds (e.g., 60). oneOf: - description: Duration string (e.g., "60s", "5m", "1h"). example: 60s type: string - description: Duration in seconds. example: 60 type: number securitySchemes: api_key: description: API Keys in: header name: SigNoz-Api-Key type: apiKey tokenizer: bearerFormat: Tokenizer description: Tokens generated by the tokenizer scheme: bearer type: http