This guide assumes you are familiar with Alerts already. If not, please review API Monitors & Alerts
Adding an alert rule
To create an alert, open up a Time Series view. The alert will monitor the exact chart you’re already looking at, so if you want to add any filters or change the time interval, you can do so in the chart parameters. Once this is all set, click Create Alert button, which will open a small pop up to enter the alert rule name and details on conditions such as the thresholds.
Any filters you added to your time series chart will also be carried over into the alert rule. For example, to only alert when the response.status is 500 or 502, simply add an events filter for not equal 500 and not equal 502.
Chart Group By
By adding a group by, your alert will be multi-dimensional and be checked for each of the group by’s values. For example, instead of just get alerted when the overall number of 5xx errors are over a certain threshold, you can break this down by customer and create a trigger for each distinct user id or user email. The email will detail which user id’s are over the threshold.
Similarly, you can break down alerts by the endpoint used, or any other field.
The metric is the actual metric to the checked against such as event count or average duration. Any of the default metrics in the chart are supported.
Because a time series metric by nature is over a certain interval, alerts require an interval. For example, if you select event count as your chart metric and the chart is currently set to 15 minutes, then your alert will be tracking the event count over rolling 15 minute periods.
Hourly or smaller intervals are evaluated continuously (i.e. real-time) in overlapping rolling windows. So if you select 15 minutes, Moesif will not only check from 1:00 to 1:15pm, but it’ll also track 1:01 to 1:16pm, and so on. Daily or larger intervals are evaluated only once at beginning of each calendar interval and is based on your application’s timezone which can be set under Apps and Team settings.
Alert Rule Settings
In addition to the chart conditions rules, there will be additional settings to configure once you click the Create Alert button.
Alert Name: Select a friendly name for your alert, which you can use to identify in emails and notifications.
Channels: Select the channels you would like to send the alert notifications to such as an email channel or Slack channel. If you already have channels created, you may select one here. If not you will need to set up new channels via the New Channel button.
Moesif supports two types of alerts. Static alerts which are threshold based and dynamic alerts which is leverages Moesif’s anomaly detection and your historical trendlines for the metric.
Static Alerts: This type of alert allows you to set a nominal threshold for your tracking metric for when the alert will be triggered. You can also select an operator such as greater than 100 or less than 5000.
Dynamic Alert: this type of alert looks at historical data to learn what are acceptable error rates and only send alerts when there is a change. Because each application and environment is different Moesif still provides a way to change the detection sensitivities similar to modifying fixed rules.
If you feel that you’re receiving too few or too many false alerts, you can adjust the sensitivity. To avoid sending too many alerts, Moesif doesn’t use fixed rules like send alert when errors/min > 2%.
Moesif has slow, medium, and fast detectors. If you’re receiving too many false alerts, drag slider right. If you want to be notified of every minor issue, drag the slider right.
|Detector||Alert Name||When to decrease sensitivity|
|Short duration spike detection||SPIKE||Your API receives a low volume of traffic so small fluctuations in error rates throws off the spike detector|
|Normal level change detection||RISE/FALL|
|Slow positive trend detection||POSITIVE TREND||Your API has seasonal patterns (such as an API only used during working hours which naturally has an increase in error rates at 9am)|
Advance settings allow you to define the maximum notification frequency and a maintenance window.
While Moesif tries to minimize alert fatigue, you can control this further by specifying the maximum notification frequency. If set to 15 mins, then if an alert was sent at 2:45PM, Moesif won’t send a second alert for this same rule until 3:00PM at the earliest.
Maintenance window is a quiet period where alerts will not be sent. For example, if you have a cron job that performs some maintenance that brings down a service from 5AM to 6AM UTC everyday, you can set this schedule to avoid receiving false alerts.
|Start Time||The start time for maintenance window in 24 hour clock time||05:00|
|End Time||The end time for maintenance window in 24 hour clock time||06:00|
|Timezone||The timezone to use for the start and end time||PDT|
Adding an Channel
In addition to being able to create channels while creating alerts, channels could also be created in Alerting by clicking on “+ Channel”
Moesif currently supports four types of Channel, email, sms, slack, and pagerduty.