1. Packages
  2. Ibm Provider
  3. API Docs
  4. LogsAlertDefinition
ibm 1.85.0-beta0 published on Wednesday, Oct 29, 2025 by ibm-cloud

ibm.LogsAlertDefinition

Start a Neo task
Explain and create an ibm.LogsAlertDefinition resource
ibm logo
ibm 1.85.0-beta0 published on Wednesday, Oct 29, 2025 by ibm-cloud

    Manage ICL Alerts using ibm.LogsAlertDefinition resource

    Example Usage

    standard immediate alert

    Example coming soon!
    
    Example coming soon!
    
    Example coming soon!
    
    Example coming soon!
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsImmediateArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsImmediateLogsFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var standardImmediate = new LogsAlertDefinition("standardImmediate", LogsAlertDefinitionArgs.builder()
                .enabled(true)
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(10)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .logsImmediate(LogsAlertDefinitionLogsImmediateArgs.builder()
                    .logsFilter(LogsAlertDefinitionLogsImmediateLogsFilterArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterArgs.builder()
                            .labelFilters(LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersArgs.builder()
                                .applicationName(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                                .subsystemName(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                                .build())
                            .luceneQuery("push")
                            .build())
                        .build())
                    .notificationPayloadFilters()
                    .build())
                .phantomMode(false)
                .priority("p1")
                .region("eu-gb")
                .type("logs_immediate_or_unspecified")
                .build());
    
        }
    }
    
    resources:
      standardImmediate:
        type: ibm:LogsAlertDefinition
        properties:
          enabled: true
          incidentsSettings:
            minutes: 10
            notifyOn: triggered_only_unspecified
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          logsImmediate:
            logsFilter:
              simpleFilter:
                labelFilters:
                  applicationName:
                    - operation: is_or_unspecified
                      value: sev1
                  subsystemName:
                    - operation: is_or_unspecified
                      value: sev1-logs
                luceneQuery: push
            notificationPayloadFilters: []
          phantomMode: false
          priority: p1
          region: eu-gb
          type: logs_immediate_or_unspecified
    

    standard less than threshold alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const standardLessThanThreshold = new ibm.LogsAlertDefinition("standardLessThanThreshold", {
        description: "standard-less-than",
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        type: "logs_threshold",
        incidentsSettings: {
            minutes: 1,
            notifyOn: "triggered_only_unspecified",
        },
        logsThreshold: {
            conditionType: "less_than",
            evaluationDelayMs: 0,
            notificationPayloadFilters: [],
            logsFilter: {
                simpleFilter: {
                    luceneQuery: "\"push\"",
                    labelFilters: {
                        applicationNames: [{
                            operation: "is_or_unspecified",
                            value: "sev1",
                        }],
                        subsystemNames: [{
                            operation: "is_or_unspecified",
                            value: "sev1-logs",
                        }],
                    },
                },
            },
            rules: [
                {
                    condition: {
                        threshold: 1,
                        timeWindow: {
                            logsTimeWindowSpecificValue: "minutes_5_or_unspecified",
                        },
                    },
                    override: {
                        priority: "p2",
                    },
                },
                {
                    condition: {
                        threshold: 2,
                        timeWindow: {
                            logsTimeWindowSpecificValue: "minutes_10",
                        },
                    },
                    override: {
                        priority: "p3",
                    },
                },
                {
                    condition: {
                        threshold: 1,
                        timeWindow: {
                            logsTimeWindowSpecificValue: "minutes_10",
                        },
                    },
                    override: {
                        priority: "p1",
                    },
                },
            ],
            undetectedValuesManagement: {
                autoRetireTimeframe: "never_or_unspecified",
                triggerUndetectedValues: false,
            },
        },
        notificationGroup: {
            webhooks: [{
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    standard_less_than_threshold = ibm.LogsAlertDefinition("standardLessThanThreshold",
        description="standard-less-than",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        type="logs_threshold",
        incidents_settings={
            "minutes": 1,
            "notify_on": "triggered_only_unspecified",
        },
        logs_threshold={
            "condition_type": "less_than",
            "evaluation_delay_ms": 0,
            "notification_payload_filters": [],
            "logs_filter": {
                "simple_filter": {
                    "lucene_query": "\"push\"",
                    "label_filters": {
                        "application_names": [{
                            "operation": "is_or_unspecified",
                            "value": "sev1",
                        }],
                        "subsystem_names": [{
                            "operation": "is_or_unspecified",
                            "value": "sev1-logs",
                        }],
                    },
                },
            },
            "rules": [
                {
                    "condition": {
                        "threshold": 1,
                        "time_window": {
                            "logs_time_window_specific_value": "minutes_5_or_unspecified",
                        },
                    },
                    "override": {
                        "priority": "p2",
                    },
                },
                {
                    "condition": {
                        "threshold": 2,
                        "time_window": {
                            "logs_time_window_specific_value": "minutes_10",
                        },
                    },
                    "override": {
                        "priority": "p3",
                    },
                },
                {
                    "condition": {
                        "threshold": 1,
                        "time_window": {
                            "logs_time_window_specific_value": "minutes_10",
                        },
                    },
                    "override": {
                        "priority": "p1",
                    },
                },
            ],
            "undetected_values_management": {
                "auto_retire_timeframe": "never_or_unspecified",
                "trigger_undetected_values": False,
            },
        },
        notification_group={
            "webhooks": [{
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "standardLessThanThreshold", &ibm.LogsAlertDefinitionArgs{
    			Description: pulumi.String("standard-less-than"),
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Type:        pulumi.String("logs_threshold"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(1),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			LogsThreshold: &ibm.LogsAlertDefinitionLogsThresholdArgs{
    				ConditionType:              pulumi.String("less_than"),
    				EvaluationDelayMs:          pulumi.Float64(0),
    				NotificationPayloadFilters: pulumi.StringArray{},
    				LogsFilter: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"push\""),
    						LabelFilters: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs{
    							ApplicationNames: ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    								&ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    									Operation: pulumi.String("is_or_unspecified"),
    									Value:     pulumi.String("sev1"),
    								},
    							},
    							SubsystemNames: ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    								&ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    									Operation: pulumi.String("is_or_unspecified"),
    									Value:     pulumi.String("sev1-logs"),
    								},
    							},
    						},
    					},
    				},
    				Rules: ibm.LogsAlertDefinitionLogsThresholdRuleArray{
    					&ibm.LogsAlertDefinitionLogsThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionArgs{
    							Threshold: pulumi.Float64(1),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs{
    								LogsTimeWindowSpecificValue: pulumi.String("minutes_5_or_unspecified"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionLogsThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p2"),
    						},
    					},
    					&ibm.LogsAlertDefinitionLogsThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionArgs{
    							Threshold: pulumi.Float64(2),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs{
    								LogsTimeWindowSpecificValue: pulumi.String("minutes_10"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionLogsThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p3"),
    						},
    					},
    					&ibm.LogsAlertDefinitionLogsThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionArgs{
    							Threshold: pulumi.Float64(1),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs{
    								LogsTimeWindowSpecificValue: pulumi.String("minutes_10"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionLogsThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p1"),
    						},
    					},
    				},
    				UndetectedValuesManagement: &ibm.LogsAlertDefinitionLogsThresholdUndetectedValuesManagementArgs{
    					AutoRetireTimeframe:     pulumi.String("never_or_unspecified"),
    					TriggerUndetectedValues: pulumi.Bool(false),
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var standardLessThanThreshold = new Ibm.LogsAlertDefinition("standardLessThanThreshold", new()
        {
            Description = "standard-less-than",
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Type = "logs_threshold",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 1,
                NotifyOn = "triggered_only_unspecified",
            },
            LogsThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdArgs
            {
                ConditionType = "less_than",
                EvaluationDelayMs = 0,
                NotificationPayloadFilters = new() { },
                LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs
                    {
                        LuceneQuery = "\"push\"",
                        LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs
                        {
                            ApplicationNames = new[]
                            {
                                new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                                {
                                    Operation = "is_or_unspecified",
                                    Value = "sev1",
                                },
                            },
                            SubsystemNames = new[]
                            {
                                new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                                {
                                    Operation = "is_or_unspecified",
                                    Value = "sev1-logs",
                                },
                            },
                        },
                    },
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionArgs
                        {
                            Threshold = 1,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs
                            {
                                LogsTimeWindowSpecificValue = "minutes_5_or_unspecified",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleOverrideArgs
                        {
                            Priority = "p2",
                        },
                    },
                    new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionArgs
                        {
                            Threshold = 2,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs
                            {
                                LogsTimeWindowSpecificValue = "minutes_10",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleOverrideArgs
                        {
                            Priority = "p3",
                        },
                    },
                    new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionArgs
                        {
                            Threshold = 1,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs
                            {
                                LogsTimeWindowSpecificValue = "minutes_10",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleOverrideArgs
                        {
                            Priority = "p1",
                        },
                    },
                },
                UndetectedValuesManagement = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdUndetectedValuesManagementArgs
                {
                    AutoRetireTimeframe = "never_or_unspecified",
                    TriggerUndetectedValues = false,
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdLogsFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdUndetectedValuesManagementArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var standardLessThanThreshold = new LogsAlertDefinition("standardLessThanThreshold", LogsAlertDefinitionArgs.builder()
                .description("standard-less-than")
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .type("logs_threshold")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(1)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .logsThreshold(LogsAlertDefinitionLogsThresholdArgs.builder()
                    .conditionType("less_than")
                    .evaluationDelayMs(0)
                    .notificationPayloadFilters()
                    .logsFilter(LogsAlertDefinitionLogsThresholdLogsFilterArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs.builder()
                            .luceneQuery("\"push\"")
                            .labelFilters(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs.builder()
                                .applicationNames(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                                    .operation("is_or_unspecified")
                                    .value("sev1")
                                    .build())
                                .subsystemNames(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                                    .operation("is_or_unspecified")
                                    .value("sev1-logs")
                                    .build())
                                .build())
                            .build())
                        .build())
                    .rules(                
                        LogsAlertDefinitionLogsThresholdRuleArgs.builder()
                            .condition(LogsAlertDefinitionLogsThresholdRuleConditionArgs.builder()
                                .threshold(1)
                                .timeWindow(LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs.builder()
                                    .logsTimeWindowSpecificValue("minutes_5_or_unspecified")
                                    .build())
                                .build())
                            .override(LogsAlertDefinitionLogsThresholdRuleOverrideArgs.builder()
                                .priority("p2")
                                .build())
                            .build(),
                        LogsAlertDefinitionLogsThresholdRuleArgs.builder()
                            .condition(LogsAlertDefinitionLogsThresholdRuleConditionArgs.builder()
                                .threshold(2)
                                .timeWindow(LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs.builder()
                                    .logsTimeWindowSpecificValue("minutes_10")
                                    .build())
                                .build())
                            .override(LogsAlertDefinitionLogsThresholdRuleOverrideArgs.builder()
                                .priority("p3")
                                .build())
                            .build(),
                        LogsAlertDefinitionLogsThresholdRuleArgs.builder()
                            .condition(LogsAlertDefinitionLogsThresholdRuleConditionArgs.builder()
                                .threshold(1)
                                .timeWindow(LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs.builder()
                                    .logsTimeWindowSpecificValue("minutes_10")
                                    .build())
                                .build())
                            .override(LogsAlertDefinitionLogsThresholdRuleOverrideArgs.builder()
                                .priority("p1")
                                .build())
                            .build())
                    .undetectedValuesManagement(LogsAlertDefinitionLogsThresholdUndetectedValuesManagementArgs.builder()
                        .autoRetireTimeframe("never_or_unspecified")
                        .triggerUndetectedValues(false)
                        .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      standardLessThanThreshold:
        type: ibm:LogsAlertDefinition
        properties:
          description: standard-less-than
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          type: logs_threshold
          incidentsSettings:
            minutes: 1
            notifyOn: triggered_only_unspecified
          logsThreshold:
            conditionType: less_than
            evaluationDelayMs: 0
            notificationPayloadFilters: []
            logsFilter:
              simpleFilter:
                luceneQuery: '"push"'
                labelFilters:
                  applicationNames:
                    - operation: is_or_unspecified
                      value: sev1
                  subsystemNames:
                    - operation: is_or_unspecified
                      value: sev1-logs
            rules:
              - condition:
                  threshold: 1
                  timeWindow:
                    logsTimeWindowSpecificValue: minutes_5_or_unspecified
                override:
                  priority: p2
              - condition:
                  threshold: 2
                  timeWindow:
                    logsTimeWindowSpecificValue: minutes_10
                override:
                  priority: p3
              - condition:
                  threshold: 1
                  timeWindow:
                    logsTimeWindowSpecificValue: minutes_10
                override:
                  priority: p1
            undetectedValuesManagement:
              autoRetireTimeframe: never_or_unspecified
              triggerUndetectedValues: false
          notificationGroup:
            webhooks:
              - integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    standard more than alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const standardMoreThan = new ibm.LogsAlertDefinition("standardMoreThan", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p3",
        type: "logs_threshold",
        incidentsSettings: {
            minutes: 1,
            notifyOn: "triggered_only_unspecified",
        },
        logsThreshold: {
            conditionType: "more_than_or_unspecified",
            evaluationDelayMs: 0,
            notificationPayloadFilters: [],
            logsFilter: {
                simpleFilter: {
                    luceneQuery: "\"push\"",
                    labelFilters: {
                        applicationNames: [{
                            operation: "is_or_unspecified",
                            value: "sev4",
                        }],
                        subsystemNames: [{
                            operation: "is_or_unspecified",
                            value: "sev4-logs",
                        }],
                    },
                },
            },
            rules: [
                {
                    condition: {
                        threshold: 1,
                        timeWindow: {
                            logsTimeWindowSpecificValue: "minutes_10",
                        },
                    },
                    override: {
                        priority: "p3",
                    },
                },
                {
                    condition: {
                        threshold: 1,
                        timeWindow: {
                            logsTimeWindowSpecificValue: "minutes_5_or_unspecified",
                        },
                    },
                    override: {
                        priority: "p2",
                    },
                },
            ],
        },
        notificationGroup: {
            webhooks: [{
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    standard_more_than = ibm.LogsAlertDefinition("standardMoreThan",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p3",
        type="logs_threshold",
        incidents_settings={
            "minutes": 1,
            "notify_on": "triggered_only_unspecified",
        },
        logs_threshold={
            "condition_type": "more_than_or_unspecified",
            "evaluation_delay_ms": 0,
            "notification_payload_filters": [],
            "logs_filter": {
                "simple_filter": {
                    "lucene_query": "\"push\"",
                    "label_filters": {
                        "application_names": [{
                            "operation": "is_or_unspecified",
                            "value": "sev4",
                        }],
                        "subsystem_names": [{
                            "operation": "is_or_unspecified",
                            "value": "sev4-logs",
                        }],
                    },
                },
            },
            "rules": [
                {
                    "condition": {
                        "threshold": 1,
                        "time_window": {
                            "logs_time_window_specific_value": "minutes_10",
                        },
                    },
                    "override": {
                        "priority": "p3",
                    },
                },
                {
                    "condition": {
                        "threshold": 1,
                        "time_window": {
                            "logs_time_window_specific_value": "minutes_5_or_unspecified",
                        },
                    },
                    "override": {
                        "priority": "p2",
                    },
                },
            ],
        },
        notification_group={
            "webhooks": [{
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "standardMoreThan", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p3"),
    			Type:        pulumi.String("logs_threshold"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(1),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			LogsThreshold: &ibm.LogsAlertDefinitionLogsThresholdArgs{
    				ConditionType:              pulumi.String("more_than_or_unspecified"),
    				EvaluationDelayMs:          pulumi.Float64(0),
    				NotificationPayloadFilters: pulumi.StringArray{},
    				LogsFilter: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"push\""),
    						LabelFilters: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs{
    							ApplicationNames: ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    								&ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    									Operation: pulumi.String("is_or_unspecified"),
    									Value:     pulumi.String("sev4"),
    								},
    							},
    							SubsystemNames: ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    								&ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    									Operation: pulumi.String("is_or_unspecified"),
    									Value:     pulumi.String("sev4-logs"),
    								},
    							},
    						},
    					},
    				},
    				Rules: ibm.LogsAlertDefinitionLogsThresholdRuleArray{
    					&ibm.LogsAlertDefinitionLogsThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionArgs{
    							Threshold: pulumi.Float64(1),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs{
    								LogsTimeWindowSpecificValue: pulumi.String("minutes_10"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionLogsThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p3"),
    						},
    					},
    					&ibm.LogsAlertDefinitionLogsThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionArgs{
    							Threshold: pulumi.Float64(1),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs{
    								LogsTimeWindowSpecificValue: pulumi.String("minutes_5_or_unspecified"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionLogsThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p2"),
    						},
    					},
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var standardMoreThan = new Ibm.LogsAlertDefinition("standardMoreThan", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p3",
            Type = "logs_threshold",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 1,
                NotifyOn = "triggered_only_unspecified",
            },
            LogsThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdArgs
            {
                ConditionType = "more_than_or_unspecified",
                EvaluationDelayMs = 0,
                NotificationPayloadFilters = new() { },
                LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs
                    {
                        LuceneQuery = "\"push\"",
                        LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs
                        {
                            ApplicationNames = new[]
                            {
                                new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                                {
                                    Operation = "is_or_unspecified",
                                    Value = "sev4",
                                },
                            },
                            SubsystemNames = new[]
                            {
                                new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                                {
                                    Operation = "is_or_unspecified",
                                    Value = "sev4-logs",
                                },
                            },
                        },
                    },
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionArgs
                        {
                            Threshold = 1,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs
                            {
                                LogsTimeWindowSpecificValue = "minutes_10",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleOverrideArgs
                        {
                            Priority = "p3",
                        },
                    },
                    new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionArgs
                        {
                            Threshold = 1,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs
                            {
                                LogsTimeWindowSpecificValue = "minutes_5_or_unspecified",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleOverrideArgs
                        {
                            Priority = "p2",
                        },
                    },
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdLogsFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var standardMoreThan = new LogsAlertDefinition("standardMoreThan", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p3")
                .type("logs_threshold")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(1)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .logsThreshold(LogsAlertDefinitionLogsThresholdArgs.builder()
                    .conditionType("more_than_or_unspecified")
                    .evaluationDelayMs(0)
                    .notificationPayloadFilters()
                    .logsFilter(LogsAlertDefinitionLogsThresholdLogsFilterArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs.builder()
                            .luceneQuery("\"push\"")
                            .labelFilters(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs.builder()
                                .applicationNames(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                                    .operation("is_or_unspecified")
                                    .value("sev4")
                                    .build())
                                .subsystemNames(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                                    .operation("is_or_unspecified")
                                    .value("sev4-logs")
                                    .build())
                                .build())
                            .build())
                        .build())
                    .rules(                
                        LogsAlertDefinitionLogsThresholdRuleArgs.builder()
                            .condition(LogsAlertDefinitionLogsThresholdRuleConditionArgs.builder()
                                .threshold(1)
                                .timeWindow(LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs.builder()
                                    .logsTimeWindowSpecificValue("minutes_10")
                                    .build())
                                .build())
                            .override(LogsAlertDefinitionLogsThresholdRuleOverrideArgs.builder()
                                .priority("p3")
                                .build())
                            .build(),
                        LogsAlertDefinitionLogsThresholdRuleArgs.builder()
                            .condition(LogsAlertDefinitionLogsThresholdRuleConditionArgs.builder()
                                .threshold(1)
                                .timeWindow(LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs.builder()
                                    .logsTimeWindowSpecificValue("minutes_5_or_unspecified")
                                    .build())
                                .build())
                            .override(LogsAlertDefinitionLogsThresholdRuleOverrideArgs.builder()
                                .priority("p2")
                                .build())
                            .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      standardMoreThan:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p3
          type: logs_threshold
          incidentsSettings:
            minutes: 1
            notifyOn: triggered_only_unspecified
          logsThreshold:
            conditionType: more_than_or_unspecified
            evaluationDelayMs: 0
            notificationPayloadFilters: []
            logsFilter:
              simpleFilter:
                luceneQuery: '"push"'
                labelFilters:
                  applicationNames:
                    - operation: is_or_unspecified
                      value: sev4
                  subsystemNames:
                    - operation: is_or_unspecified
                      value: sev4-logs
            rules:
              - condition:
                  threshold: 1
                  timeWindow:
                    logsTimeWindowSpecificValue: minutes_10
                override:
                  priority: p3
              - condition:
                  threshold: 1
                  timeWindow:
                    logsTimeWindowSpecificValue: minutes_5_or_unspecified
                override:
                  priority: p2
          notificationGroup:
            webhooks:
              - integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    standard more than usual alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const standardMoreThanUsual = new ibm.LogsAlertDefinition("standardMoreThanUsual", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p5_or_unspecified",
        type: "logs_anomaly",
        incidentsSettings: {
            minutes: 1,
            notifyOn: "triggered_only_unspecified",
        },
        logsAnomaly: {
            conditionType: "more_than_usual_or_unspecified",
            evaluationDelayMs: 0,
            notificationPayloadFilters: [],
            logsFilter: {
                simpleFilter: {
                    luceneQuery: "\"push\"",
                    labelFilters: {
                        severities: [],
                        applicationNames: [
                            {
                                operation: "is_or_unspecified",
                                value: "sev5",
                            },
                            {
                                operation: "is_or_unspecified",
                                value: "sev4",
                            },
                        ],
                        subsystemNames: [{
                            operation: "is_or_unspecified",
                            value: "sev4-logs",
                        }],
                    },
                },
            },
            rules: [{
                condition: {
                    minimumThreshold: 1,
                    timeWindow: {
                        logsTimeWindowSpecificValue: "minutes_5_or_unspecified",
                    },
                },
            }],
        },
        notificationGroup: {
            webhooks: [{
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    standard_more_than_usual = ibm.LogsAlertDefinition("standardMoreThanUsual",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p5_or_unspecified",
        type="logs_anomaly",
        incidents_settings={
            "minutes": 1,
            "notify_on": "triggered_only_unspecified",
        },
        logs_anomaly={
            "condition_type": "more_than_usual_or_unspecified",
            "evaluation_delay_ms": 0,
            "notification_payload_filters": [],
            "logs_filter": {
                "simple_filter": {
                    "lucene_query": "\"push\"",
                    "label_filters": {
                        "severities": [],
                        "application_names": [
                            {
                                "operation": "is_or_unspecified",
                                "value": "sev5",
                            },
                            {
                                "operation": "is_or_unspecified",
                                "value": "sev4",
                            },
                        ],
                        "subsystem_names": [{
                            "operation": "is_or_unspecified",
                            "value": "sev4-logs",
                        }],
                    },
                },
            },
            "rules": [{
                "condition": {
                    "minimum_threshold": 1,
                    "time_window": {
                        "logs_time_window_specific_value": "minutes_5_or_unspecified",
                    },
                },
            }],
        },
        notification_group={
            "webhooks": [{
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "standardMoreThanUsual", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p5_or_unspecified"),
    			Type:        pulumi.String("logs_anomaly"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(1),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			LogsAnomaly: &ibm.LogsAlertDefinitionLogsAnomalyArgs{
    				ConditionType:              pulumi.String("more_than_usual_or_unspecified"),
    				EvaluationDelayMs:          pulumi.Float64(0),
    				NotificationPayloadFilters: pulumi.StringArray{},
    				LogsFilter: &ibm.LogsAlertDefinitionLogsAnomalyLogsFilterArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"push\""),
    						LabelFilters: &ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersArgs{
    							Severities: pulumi.StringArray{},
    							ApplicationNames: ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    								&ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    									Operation: pulumi.String("is_or_unspecified"),
    									Value:     pulumi.String("sev5"),
    								},
    								&ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    									Operation: pulumi.String("is_or_unspecified"),
    									Value:     pulumi.String("sev4"),
    								},
    							},
    							SubsystemNames: ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    								&ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    									Operation: pulumi.String("is_or_unspecified"),
    									Value:     pulumi.String("sev4-logs"),
    								},
    							},
    						},
    					},
    				},
    				Rules: ibm.LogsAlertDefinitionLogsAnomalyRuleArray{
    					&ibm.LogsAlertDefinitionLogsAnomalyRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsAnomalyRuleConditionArgs{
    							MinimumThreshold: pulumi.Float64(1),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindowArgs{
    								LogsTimeWindowSpecificValue: pulumi.String("minutes_5_or_unspecified"),
    							},
    						},
    					},
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var standardMoreThanUsual = new Ibm.LogsAlertDefinition("standardMoreThanUsual", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p5_or_unspecified",
            Type = "logs_anomaly",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 1,
                NotifyOn = "triggered_only_unspecified",
            },
            LogsAnomaly = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyArgs
            {
                ConditionType = "more_than_usual_or_unspecified",
                EvaluationDelayMs = 0,
                NotificationPayloadFilters = new() { },
                LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterArgs
                    {
                        LuceneQuery = "\"push\"",
                        LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersArgs
                        {
                            Severities = new() { },
                            ApplicationNames = new[]
                            {
                                new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                                {
                                    Operation = "is_or_unspecified",
                                    Value = "sev5",
                                },
                                new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                                {
                                    Operation = "is_or_unspecified",
                                    Value = "sev4",
                                },
                            },
                            SubsystemNames = new[]
                            {
                                new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                                {
                                    Operation = "is_or_unspecified",
                                    Value = "sev4-logs",
                                },
                            },
                        },
                    },
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyRuleConditionArgs
                        {
                            MinimumThreshold = 1,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindowArgs
                            {
                                LogsTimeWindowSpecificValue = "minutes_5_or_unspecified",
                            },
                        },
                    },
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsAnomalyArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsAnomalyLogsFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var standardMoreThanUsual = new LogsAlertDefinition("standardMoreThanUsual", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p5_or_unspecified")
                .type("logs_anomaly")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(1)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .logsAnomaly(LogsAlertDefinitionLogsAnomalyArgs.builder()
                    .conditionType("more_than_usual_or_unspecified")
                    .evaluationDelayMs(0)
                    .notificationPayloadFilters()
                    .logsFilter(LogsAlertDefinitionLogsAnomalyLogsFilterArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterArgs.builder()
                            .luceneQuery("\"push\"")
                            .labelFilters(LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersArgs.builder()
                                .severities()
                                .applicationNames(                            
                                    LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                                        .operation("is_or_unspecified")
                                        .value("sev5")
                                        .build(),
                                    LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                                        .operation("is_or_unspecified")
                                        .value("sev4")
                                        .build())
                                .subsystemNames(LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                                    .operation("is_or_unspecified")
                                    .value("sev4-logs")
                                    .build())
                                .build())
                            .build())
                        .build())
                    .rules(LogsAlertDefinitionLogsAnomalyRuleArgs.builder()
                        .condition(LogsAlertDefinitionLogsAnomalyRuleConditionArgs.builder()
                            .minimumThreshold(1)
                            .timeWindow(LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindowArgs.builder()
                                .logsTimeWindowSpecificValue("minutes_5_or_unspecified")
                                .build())
                            .build())
                        .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      standardMoreThanUsual:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p5_or_unspecified
          type: logs_anomaly
          incidentsSettings:
            minutes: 1
            notifyOn: triggered_only_unspecified
          logsAnomaly:
            conditionType: more_than_usual_or_unspecified
            evaluationDelayMs: 0
            notificationPayloadFilters: []
            logsFilter:
              simpleFilter:
                luceneQuery: '"push"'
                labelFilters:
                  severities: []
                  applicationNames:
                    - operation: is_or_unspecified
                      value: sev5
                    - operation: is_or_unspecified
                      value: sev4
                  subsystemNames:
                    - operation: is_or_unspecified
                      value: sev4-logs
            rules:
              - condition:
                  minimumThreshold: 1
                  timeWindow:
                    logsTimeWindowSpecificValue: minutes_5_or_unspecified
          notificationGroup:
            webhooks:
              - integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    Time relative less than alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const testTimeRelativeLessThan = new ibm.LogsAlertDefinition("testTimeRelativeLessThan", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p2",
        type: "logs_time_relative_threshold",
        incidentsSettings: {
            minutes: 70,
            notifyOn: "triggered_only_unspecified",
        },
        logsTimeRelativeThreshold: {
            conditionType: "less_than",
            evaluationDelayMs: 0,
            ignoreInfinity: true,
            notificationPayloadFilters: [],
            logsFilter: {
                simpleFilter: {
                    luceneQuery: "\"This is my second log\"",
                },
            },
            rules: [{
                condition: {
                    comparedTo: "previous_hour_or_unspecified",
                    threshold: 4,
                },
                override: {
                    priority: "p2",
                },
            }],
            undetectedValuesManagement: {
                autoRetireTimeframe: "never_or_unspecified",
                triggerUndetectedValues: false,
            },
        },
        notificationGroup: {
            webhooks: [{
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    test_time_relative_less_than = ibm.LogsAlertDefinition("testTimeRelativeLessThan",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p2",
        type="logs_time_relative_threshold",
        incidents_settings={
            "minutes": 70,
            "notify_on": "triggered_only_unspecified",
        },
        logs_time_relative_threshold={
            "condition_type": "less_than",
            "evaluation_delay_ms": 0,
            "ignore_infinity": True,
            "notification_payload_filters": [],
            "logs_filter": {
                "simple_filter": {
                    "lucene_query": "\"This is my second log\"",
                },
            },
            "rules": [{
                "condition": {
                    "compared_to": "previous_hour_or_unspecified",
                    "threshold": 4,
                },
                "override": {
                    "priority": "p2",
                },
            }],
            "undetected_values_management": {
                "auto_retire_timeframe": "never_or_unspecified",
                "trigger_undetected_values": False,
            },
        },
        notification_group={
            "webhooks": [{
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "testTimeRelativeLessThan", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p2"),
    			Type:        pulumi.String("logs_time_relative_threshold"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(70),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			LogsTimeRelativeThreshold: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdArgs{
    				ConditionType:              pulumi.String("less_than"),
    				EvaluationDelayMs:          pulumi.Float64(0),
    				IgnoreInfinity:             pulumi.Bool(true),
    				NotificationPayloadFilters: pulumi.StringArray{},
    				LogsFilter: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"This is my second log\""),
    					},
    				},
    				Rules: ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArray{
    					&ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs{
    							ComparedTo: pulumi.String("previous_hour_or_unspecified"),
    							Threshold:  pulumi.Float64(4),
    						},
    						Override: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p2"),
    						},
    					},
    				},
    				UndetectedValuesManagement: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagementArgs{
    					AutoRetireTimeframe:     pulumi.String("never_or_unspecified"),
    					TriggerUndetectedValues: pulumi.Bool(false),
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var testTimeRelativeLessThan = new Ibm.LogsAlertDefinition("testTimeRelativeLessThan", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p2",
            Type = "logs_time_relative_threshold",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 70,
                NotifyOn = "triggered_only_unspecified",
            },
            LogsTimeRelativeThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdArgs
            {
                ConditionType = "less_than",
                EvaluationDelayMs = 0,
                IgnoreInfinity = true,
                NotificationPayloadFilters = new() { },
                LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs
                    {
                        LuceneQuery = "\"This is my second log\"",
                    },
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs
                        {
                            ComparedTo = "previous_hour_or_unspecified",
                            Threshold = 4,
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs
                        {
                            Priority = "p2",
                        },
                    },
                },
                UndetectedValuesManagement = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagementArgs
                {
                    AutoRetireTimeframe = "never_or_unspecified",
                    TriggerUndetectedValues = false,
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsTimeRelativeThresholdArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagementArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var testTimeRelativeLessThan = new LogsAlertDefinition("testTimeRelativeLessThan", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p2")
                .type("logs_time_relative_threshold")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(70)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .logsTimeRelativeThreshold(LogsAlertDefinitionLogsTimeRelativeThresholdArgs.builder()
                    .conditionType("less_than")
                    .evaluationDelayMs(0)
                    .ignoreInfinity(true)
                    .notificationPayloadFilters()
                    .logsFilter(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs.builder()
                            .luceneQuery("\"This is my second log\"")
                            .build())
                        .build())
                    .rules(LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs.builder()
                        .condition(LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs.builder()
                            .comparedTo("previous_hour_or_unspecified")
                            .threshold(4)
                            .build())
                        .override(LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs.builder()
                            .priority("p2")
                            .build())
                        .build())
                    .undetectedValuesManagement(LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagementArgs.builder()
                        .autoRetireTimeframe("never_or_unspecified")
                        .triggerUndetectedValues(false)
                        .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      testTimeRelativeLessThan:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p2
          type: logs_time_relative_threshold
          incidentsSettings:
            minutes: 70
            notifyOn: triggered_only_unspecified
          logsTimeRelativeThreshold:
            conditionType: less_than
            evaluationDelayMs: 0
            ignoreInfinity: true
            notificationPayloadFilters: []
            logsFilter:
              simpleFilter:
                luceneQuery: '"This is my second log"'
            rules:
              - condition:
                  comparedTo: previous_hour_or_unspecified
                  threshold: 4
                override:
                  priority: p2
            undetectedValuesManagement:
              autoRetireTimeframe: never_or_unspecified
              triggerUndetectedValues: false
          notificationGroup:
            webhooks:
              - integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    Time relative more than alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const testTimeRelativeMoreThan = new ibm.LogsAlertDefinition("testTimeRelativeMoreThan", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p1",
        type: "logs_time_relative_threshold",
        incidentsSettings: {
            minutes: 60,
            notifyOn: "triggered_only_unspecified",
        },
        logsTimeRelativeThreshold: {
            conditionType: "more_than_or_unspecified",
            evaluationDelayMs: 0,
            ignoreInfinity: true,
            notificationPayloadFilters: [],
            logsFilter: {
                simpleFilter: {
                    luceneQuery: "\"Push and Query integration test\"",
                },
            },
            rules: [{
                condition: {
                    comparedTo: "previous_hour_or_unspecified",
                    threshold: 1,
                },
                override: {
                    priority: "p1",
                },
            }],
        },
        notificationGroup: {
            webhooks: [{
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    test_time_relative_more_than = ibm.LogsAlertDefinition("testTimeRelativeMoreThan",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p1",
        type="logs_time_relative_threshold",
        incidents_settings={
            "minutes": 60,
            "notify_on": "triggered_only_unspecified",
        },
        logs_time_relative_threshold={
            "condition_type": "more_than_or_unspecified",
            "evaluation_delay_ms": 0,
            "ignore_infinity": True,
            "notification_payload_filters": [],
            "logs_filter": {
                "simple_filter": {
                    "lucene_query": "\"Push and Query integration test\"",
                },
            },
            "rules": [{
                "condition": {
                    "compared_to": "previous_hour_or_unspecified",
                    "threshold": 1,
                },
                "override": {
                    "priority": "p1",
                },
            }],
        },
        notification_group={
            "webhooks": [{
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "testTimeRelativeMoreThan", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p1"),
    			Type:        pulumi.String("logs_time_relative_threshold"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(60),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			LogsTimeRelativeThreshold: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdArgs{
    				ConditionType:              pulumi.String("more_than_or_unspecified"),
    				EvaluationDelayMs:          pulumi.Float64(0),
    				IgnoreInfinity:             pulumi.Bool(true),
    				NotificationPayloadFilters: pulumi.StringArray{},
    				LogsFilter: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"Push and Query integration test\""),
    					},
    				},
    				Rules: ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArray{
    					&ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs{
    							ComparedTo: pulumi.String("previous_hour_or_unspecified"),
    							Threshold:  pulumi.Float64(1),
    						},
    						Override: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p1"),
    						},
    					},
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var testTimeRelativeMoreThan = new Ibm.LogsAlertDefinition("testTimeRelativeMoreThan", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p1",
            Type = "logs_time_relative_threshold",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 60,
                NotifyOn = "triggered_only_unspecified",
            },
            LogsTimeRelativeThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdArgs
            {
                ConditionType = "more_than_or_unspecified",
                EvaluationDelayMs = 0,
                IgnoreInfinity = true,
                NotificationPayloadFilters = new() { },
                LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs
                    {
                        LuceneQuery = "\"Push and Query integration test\"",
                    },
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs
                        {
                            ComparedTo = "previous_hour_or_unspecified",
                            Threshold = 1,
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs
                        {
                            Priority = "p1",
                        },
                    },
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsTimeRelativeThresholdArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var testTimeRelativeMoreThan = new LogsAlertDefinition("testTimeRelativeMoreThan", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p1")
                .type("logs_time_relative_threshold")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(60)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .logsTimeRelativeThreshold(LogsAlertDefinitionLogsTimeRelativeThresholdArgs.builder()
                    .conditionType("more_than_or_unspecified")
                    .evaluationDelayMs(0)
                    .ignoreInfinity(true)
                    .notificationPayloadFilters()
                    .logsFilter(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs.builder()
                            .luceneQuery("\"Push and Query integration test\"")
                            .build())
                        .build())
                    .rules(LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs.builder()
                        .condition(LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs.builder()
                            .comparedTo("previous_hour_or_unspecified")
                            .threshold(1)
                            .build())
                        .override(LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs.builder()
                            .priority("p1")
                            .build())
                        .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      testTimeRelativeMoreThan:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p1
          type: logs_time_relative_threshold
          incidentsSettings:
            minutes: 60
            notifyOn: triggered_only_unspecified
          logsTimeRelativeThreshold:
            conditionType: more_than_or_unspecified
            evaluationDelayMs: 0
            ignoreInfinity: true
            notificationPayloadFilters: []
            logsFilter:
              simpleFilter:
                luceneQuery: '"Push and Query integration test"'
            rules:
              - condition:
                  comparedTo: previous_hour_or_unspecified
                  threshold: 1
                override:
                  priority: p1
          notificationGroup:
            webhooks:
              - integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    ration less than alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    // ibm_logs_alert_definition.ratio_less_than:
    const ratioLessThan = new ibm.LogsAlertDefinition("ratioLessThan", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p2",
        type: "logs_ratio_threshold",
        incidentsSettings: {
            minutes: 10,
            notifyOn: "triggered_only_unspecified",
        },
        logsRatioThreshold: {
            conditionType: "less_than",
            denominatorAlias: "Query 2",
            evaluationDelayMs: 0,
            groupByFor: "both_or_unspecified",
            ignoreInfinity: true,
            notificationPayloadFilters: [],
            numeratorAlias: "Query 1",
            denominator: {
                simpleFilter: {
                    luceneQuery: "\"This is my second log\"",
                },
            },
            numerator: {
                simpleFilter: {
                    luceneQuery: "\"Push and Query integration test\"",
                },
            },
            rules: [{
                condition: {
                    threshold: 3,
                    timeWindow: {
                        logsRatioTimeWindowSpecificValue: "minutes_5_or_unspecified",
                    },
                },
                override: {
                    priority: "p2",
                },
            }],
            undetectedValuesManagement: {
                autoRetireTimeframe: "never_or_unspecified",
                triggerUndetectedValues: false,
            },
        },
        notificationGroup: {
            webhooks: [{
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    # ibm_logs_alert_definition.ratio_less_than:
    ratio_less_than = ibm.LogsAlertDefinition("ratioLessThan",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p2",
        type="logs_ratio_threshold",
        incidents_settings={
            "minutes": 10,
            "notify_on": "triggered_only_unspecified",
        },
        logs_ratio_threshold={
            "condition_type": "less_than",
            "denominator_alias": "Query 2",
            "evaluation_delay_ms": 0,
            "group_by_for": "both_or_unspecified",
            "ignore_infinity": True,
            "notification_payload_filters": [],
            "numerator_alias": "Query 1",
            "denominator": {
                "simple_filter": {
                    "lucene_query": "\"This is my second log\"",
                },
            },
            "numerator": {
                "simple_filter": {
                    "lucene_query": "\"Push and Query integration test\"",
                },
            },
            "rules": [{
                "condition": {
                    "threshold": 3,
                    "time_window": {
                        "logs_ratio_time_window_specific_value": "minutes_5_or_unspecified",
                    },
                },
                "override": {
                    "priority": "p2",
                },
            }],
            "undetected_values_management": {
                "auto_retire_timeframe": "never_or_unspecified",
                "trigger_undetected_values": False,
            },
        },
        notification_group={
            "webhooks": [{
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		// ibm_logs_alert_definition.ratio_less_than:
    		_, err := ibm.NewLogsAlertDefinition(ctx, "ratioLessThan", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p2"),
    			Type:        pulumi.String("logs_ratio_threshold"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(10),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			LogsRatioThreshold: &ibm.LogsAlertDefinitionLogsRatioThresholdArgs{
    				ConditionType:              pulumi.String("less_than"),
    				DenominatorAlias:           pulumi.String("Query 2"),
    				EvaluationDelayMs:          pulumi.Float64(0),
    				GroupByFor:                 pulumi.String("both_or_unspecified"),
    				IgnoreInfinity:             pulumi.Bool(true),
    				NotificationPayloadFilters: pulumi.StringArray{},
    				NumeratorAlias:             pulumi.String("Query 1"),
    				Denominator: &ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"This is my second log\""),
    					},
    				},
    				Numerator: &ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"Push and Query integration test\""),
    					},
    				},
    				Rules: ibm.LogsAlertDefinitionLogsRatioThresholdRuleArray{
    					&ibm.LogsAlertDefinitionLogsRatioThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs{
    							Threshold: pulumi.Float64(3),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs{
    								LogsRatioTimeWindowSpecificValue: pulumi.String("minutes_5_or_unspecified"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p2"),
    						},
    					},
    				},
    				UndetectedValuesManagement: &ibm.LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagementArgs{
    					AutoRetireTimeframe:     pulumi.String("never_or_unspecified"),
    					TriggerUndetectedValues: pulumi.Bool(false),
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        // ibm_logs_alert_definition.ratio_less_than:
        var ratioLessThan = new Ibm.LogsAlertDefinition("ratioLessThan", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p2",
            Type = "logs_ratio_threshold",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 10,
                NotifyOn = "triggered_only_unspecified",
            },
            LogsRatioThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdArgs
            {
                ConditionType = "less_than",
                DenominatorAlias = "Query 2",
                EvaluationDelayMs = 0,
                GroupByFor = "both_or_unspecified",
                IgnoreInfinity = true,
                NotificationPayloadFilters = new() { },
                NumeratorAlias = "Query 1",
                Denominator = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs
                    {
                        LuceneQuery = "\"This is my second log\"",
                    },
                },
                Numerator = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs
                    {
                        LuceneQuery = "\"Push and Query integration test\"",
                    },
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs
                        {
                            Threshold = 3,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs
                            {
                                LogsRatioTimeWindowSpecificValue = "minutes_5_or_unspecified",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs
                        {
                            Priority = "p2",
                        },
                    },
                },
                UndetectedValuesManagement = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagementArgs
                {
                    AutoRetireTimeframe = "never_or_unspecified",
                    TriggerUndetectedValues = false,
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagementArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            // ibm_logs_alert_definition.ratio_less_than:
            var ratioLessThan = new LogsAlertDefinition("ratioLessThan", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p2")
                .type("logs_ratio_threshold")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(10)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .logsRatioThreshold(LogsAlertDefinitionLogsRatioThresholdArgs.builder()
                    .conditionType("less_than")
                    .denominatorAlias("Query 2")
                    .evaluationDelayMs(0)
                    .groupByFor("both_or_unspecified")
                    .ignoreInfinity(true)
                    .notificationPayloadFilters()
                    .numeratorAlias("Query 1")
                    .denominator(LogsAlertDefinitionLogsRatioThresholdDenominatorArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs.builder()
                            .luceneQuery("\"This is my second log\"")
                            .build())
                        .build())
                    .numerator(LogsAlertDefinitionLogsRatioThresholdNumeratorArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs.builder()
                            .luceneQuery("\"Push and Query integration test\"")
                            .build())
                        .build())
                    .rules(LogsAlertDefinitionLogsRatioThresholdRuleArgs.builder()
                        .condition(LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs.builder()
                            .threshold(3)
                            .timeWindow(LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs.builder()
                                .logsRatioTimeWindowSpecificValue("minutes_5_or_unspecified")
                                .build())
                            .build())
                        .override(LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs.builder()
                            .priority("p2")
                            .build())
                        .build())
                    .undetectedValuesManagement(LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagementArgs.builder()
                        .autoRetireTimeframe("never_or_unspecified")
                        .triggerUndetectedValues(false)
                        .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      # ibm_logs_alert_definition.ratio_less_than:
      ratioLessThan:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p2
          type: logs_ratio_threshold
          incidentsSettings:
            minutes: 10
            notifyOn: triggered_only_unspecified
          logsRatioThreshold:
            conditionType: less_than
            denominatorAlias: Query 2
            evaluationDelayMs: 0
            groupByFor: both_or_unspecified
            ignoreInfinity: true
            notificationPayloadFilters: []
            numeratorAlias: Query 1
            denominator:
              simpleFilter:
                luceneQuery: '"This is my second log"'
            numerator:
              simpleFilter:
                luceneQuery: '"Push and Query integration test"'
            rules:
              - condition:
                  threshold: 3
                  timeWindow:
                    logsRatioTimeWindowSpecificValue: minutes_5_or_unspecified
                override:
                  priority: p2
            undetectedValuesManagement:
              autoRetireTimeframe: never_or_unspecified
              triggerUndetectedValues: false
          notificationGroup:
            webhooks:
              - integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    ration more than alert with multi conditions

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const ratioMoreThanMultiple = new ibm.LogsAlertDefinition("ratioMoreThanMultiple", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p4",
        type: "logs_ratio_threshold",
        incidentsSettings: {
            minutes: 10,
            notifyOn: "triggered_and_resolved",
        },
        logsRatioThreshold: {
            conditionType: "more_than_or_unspecified",
            denominatorAlias: "Query 2",
            evaluationDelayMs: 0,
            groupByFor: "both_or_unspecified",
            ignoreInfinity: true,
            notificationPayloadFilters: [],
            numeratorAlias: "Query 1",
            denominator: {
                simpleFilter: {
                    luceneQuery: "\"This is my second log\"",
                },
            },
            numerator: {
                simpleFilter: {
                    luceneQuery: "\"Push and Query integration test\"",
                },
            },
            rules: [
                {
                    condition: {
                        threshold: 2,
                        timeWindow: {
                            logsRatioTimeWindowSpecificValue: "minutes_5_or_unspecified",
                        },
                    },
                    override: {
                        priority: "p4",
                    },
                },
                {
                    condition: {
                        threshold: 4,
                        timeWindow: {
                            logsRatioTimeWindowSpecificValue: "minutes_10",
                        },
                    },
                    override: {
                        priority: "p1",
                    },
                },
            ],
        },
        notificationGroup: {
            webhooks: [{
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    ratio_more_than_multiple = ibm.LogsAlertDefinition("ratioMoreThanMultiple",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p4",
        type="logs_ratio_threshold",
        incidents_settings={
            "minutes": 10,
            "notify_on": "triggered_and_resolved",
        },
        logs_ratio_threshold={
            "condition_type": "more_than_or_unspecified",
            "denominator_alias": "Query 2",
            "evaluation_delay_ms": 0,
            "group_by_for": "both_or_unspecified",
            "ignore_infinity": True,
            "notification_payload_filters": [],
            "numerator_alias": "Query 1",
            "denominator": {
                "simple_filter": {
                    "lucene_query": "\"This is my second log\"",
                },
            },
            "numerator": {
                "simple_filter": {
                    "lucene_query": "\"Push and Query integration test\"",
                },
            },
            "rules": [
                {
                    "condition": {
                        "threshold": 2,
                        "time_window": {
                            "logs_ratio_time_window_specific_value": "minutes_5_or_unspecified",
                        },
                    },
                    "override": {
                        "priority": "p4",
                    },
                },
                {
                    "condition": {
                        "threshold": 4,
                        "time_window": {
                            "logs_ratio_time_window_specific_value": "minutes_10",
                        },
                    },
                    "override": {
                        "priority": "p1",
                    },
                },
            ],
        },
        notification_group={
            "webhooks": [{
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "ratioMoreThanMultiple", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p4"),
    			Type:        pulumi.String("logs_ratio_threshold"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(10),
    				NotifyOn: pulumi.String("triggered_and_resolved"),
    			},
    			LogsRatioThreshold: &ibm.LogsAlertDefinitionLogsRatioThresholdArgs{
    				ConditionType:              pulumi.String("more_than_or_unspecified"),
    				DenominatorAlias:           pulumi.String("Query 2"),
    				EvaluationDelayMs:          pulumi.Float64(0),
    				GroupByFor:                 pulumi.String("both_or_unspecified"),
    				IgnoreInfinity:             pulumi.Bool(true),
    				NotificationPayloadFilters: pulumi.StringArray{},
    				NumeratorAlias:             pulumi.String("Query 1"),
    				Denominator: &ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"This is my second log\""),
    					},
    				},
    				Numerator: &ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs{
    						LuceneQuery: pulumi.String("\"Push and Query integration test\""),
    					},
    				},
    				Rules: ibm.LogsAlertDefinitionLogsRatioThresholdRuleArray{
    					&ibm.LogsAlertDefinitionLogsRatioThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs{
    							Threshold: pulumi.Float64(2),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs{
    								LogsRatioTimeWindowSpecificValue: pulumi.String("minutes_5_or_unspecified"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p4"),
    						},
    					},
    					&ibm.LogsAlertDefinitionLogsRatioThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs{
    							Threshold: pulumi.Float64(4),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs{
    								LogsRatioTimeWindowSpecificValue: pulumi.String("minutes_10"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p1"),
    						},
    					},
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var ratioMoreThanMultiple = new Ibm.LogsAlertDefinition("ratioMoreThanMultiple", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p4",
            Type = "logs_ratio_threshold",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 10,
                NotifyOn = "triggered_and_resolved",
            },
            LogsRatioThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdArgs
            {
                ConditionType = "more_than_or_unspecified",
                DenominatorAlias = "Query 2",
                EvaluationDelayMs = 0,
                GroupByFor = "both_or_unspecified",
                IgnoreInfinity = true,
                NotificationPayloadFilters = new() { },
                NumeratorAlias = "Query 1",
                Denominator = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs
                    {
                        LuceneQuery = "\"This is my second log\"",
                    },
                },
                Numerator = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs
                    {
                        LuceneQuery = "\"Push and Query integration test\"",
                    },
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs
                        {
                            Threshold = 2,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs
                            {
                                LogsRatioTimeWindowSpecificValue = "minutes_5_or_unspecified",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs
                        {
                            Priority = "p4",
                        },
                    },
                    new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs
                        {
                            Threshold = 4,
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs
                            {
                                LogsRatioTimeWindowSpecificValue = "minutes_10",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs
                        {
                            Priority = "p1",
                        },
                    },
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var ratioMoreThanMultiple = new LogsAlertDefinition("ratioMoreThanMultiple", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p4")
                .type("logs_ratio_threshold")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(10)
                    .notifyOn("triggered_and_resolved")
                    .build())
                .logsRatioThreshold(LogsAlertDefinitionLogsRatioThresholdArgs.builder()
                    .conditionType("more_than_or_unspecified")
                    .denominatorAlias("Query 2")
                    .evaluationDelayMs(0)
                    .groupByFor("both_or_unspecified")
                    .ignoreInfinity(true)
                    .notificationPayloadFilters()
                    .numeratorAlias("Query 1")
                    .denominator(LogsAlertDefinitionLogsRatioThresholdDenominatorArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs.builder()
                            .luceneQuery("\"This is my second log\"")
                            .build())
                        .build())
                    .numerator(LogsAlertDefinitionLogsRatioThresholdNumeratorArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs.builder()
                            .luceneQuery("\"Push and Query integration test\"")
                            .build())
                        .build())
                    .rules(                
                        LogsAlertDefinitionLogsRatioThresholdRuleArgs.builder()
                            .condition(LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs.builder()
                                .threshold(2)
                                .timeWindow(LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs.builder()
                                    .logsRatioTimeWindowSpecificValue("minutes_5_or_unspecified")
                                    .build())
                                .build())
                            .override(LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs.builder()
                                .priority("p4")
                                .build())
                            .build(),
                        LogsAlertDefinitionLogsRatioThresholdRuleArgs.builder()
                            .condition(LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs.builder()
                                .threshold(4)
                                .timeWindow(LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs.builder()
                                    .logsRatioTimeWindowSpecificValue("minutes_10")
                                    .build())
                                .build())
                            .override(LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs.builder()
                                .priority("p1")
                                .build())
                            .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      ratioMoreThanMultiple:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p4
          type: logs_ratio_threshold
          incidentsSettings:
            minutes: 10
            notifyOn: triggered_and_resolved
          logsRatioThreshold:
            conditionType: more_than_or_unspecified
            denominatorAlias: Query 2
            evaluationDelayMs: 0
            groupByFor: both_or_unspecified
            ignoreInfinity: true
            notificationPayloadFilters: []
            numeratorAlias: Query 1
            denominator:
              simpleFilter:
                luceneQuery: '"This is my second log"'
            numerator:
              simpleFilter:
                luceneQuery: '"Push and Query integration test"'
            rules:
              - condition:
                  threshold: 2
                  timeWindow:
                    logsRatioTimeWindowSpecificValue: minutes_5_or_unspecified
                override:
                  priority: p4
              - condition:
                  threshold: 4
                  timeWindow:
                    logsRatioTimeWindowSpecificValue: minutes_10
                override:
                  priority: p1
          notificationGroup:
            webhooks:
              - integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    New value alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const newValue = new ibm.LogsAlertDefinition("newValue", {
        enabled: true,
        incidentsSettings: {
            minutes: 720,
            notifyOn: "triggered_only_unspecified",
        },
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        logsNewValue: {
            logsFilter: {
                simpleFilter: {
                    luceneQuery: "text",
                },
            },
            notificationPayloadFilters: [],
            rules: [{
                condition: {
                    keypathToTrack: "ibm.logId",
                    timeWindow: {
                        logsNewValueTimeWindowSpecificValue: "hours_12_or_unspecified",
                    },
                },
            }],
        },
        notificationGroup: {
            groupByKeys: ["ibm.logId"],
        },
        phantomMode: false,
        priority: "p5_or_unspecified",
        region: "eu-gb",
        type: "logs_new_value",
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    new_value = ibm.LogsAlertDefinition("newValue",
        enabled=True,
        incidents_settings={
            "minutes": 720,
            "notify_on": "triggered_only_unspecified",
        },
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        logs_new_value={
            "logs_filter": {
                "simple_filter": {
                    "lucene_query": "text",
                },
            },
            "notification_payload_filters": [],
            "rules": [{
                "condition": {
                    "keypath_to_track": "ibm.logId",
                    "time_window": {
                        "logs_new_value_time_window_specific_value": "hours_12_or_unspecified",
                    },
                },
            }],
        },
        notification_group={
            "group_by_keys": ["ibm.logId"],
        },
        phantom_mode=False,
        priority="p5_or_unspecified",
        region="eu-gb",
        type="logs_new_value")
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "newValue", &ibm.LogsAlertDefinitionArgs{
    			Enabled: pulumi.Bool(true),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(720),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			InstanceId: pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			LogsNewValue: &ibm.LogsAlertDefinitionLogsNewValueArgs{
    				LogsFilter: &ibm.LogsAlertDefinitionLogsNewValueLogsFilterArgs{
    					SimpleFilter: &ibm.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterArgs{
    						LuceneQuery: pulumi.String("text"),
    					},
    				},
    				NotificationPayloadFilters: pulumi.StringArray{},
    				Rules: ibm.LogsAlertDefinitionLogsNewValueRuleArray{
    					&ibm.LogsAlertDefinitionLogsNewValueRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionLogsNewValueRuleConditionArgs{
    							KeypathToTrack: pulumi.String("ibm.logId"),
    							TimeWindow: &ibm.LogsAlertDefinitionLogsNewValueRuleConditionTimeWindowArgs{
    								LogsNewValueTimeWindowSpecificValue: pulumi.String("hours_12_or_unspecified"),
    							},
    						},
    					},
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				GroupByKeys: pulumi.StringArray{
    					pulumi.String("ibm.logId"),
    				},
    			},
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p5_or_unspecified"),
    			Region:      pulumi.String("eu-gb"),
    			Type:        pulumi.String("logs_new_value"),
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var newValue = new Ibm.LogsAlertDefinition("newValue", new()
        {
            Enabled = true,
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 720,
                NotifyOn = "triggered_only_unspecified",
            },
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            LogsNewValue = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueArgs
            {
                LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueLogsFilterArgs
                {
                    SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterArgs
                    {
                        LuceneQuery = "text",
                    },
                },
                NotificationPayloadFilters = new() { },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionLogsNewValueRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueRuleConditionArgs
                        {
                            KeypathToTrack = "ibm.logId",
                            TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueRuleConditionTimeWindowArgs
                            {
                                LogsNewValueTimeWindowSpecificValue = "hours_12_or_unspecified",
                            },
                        },
                    },
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                GroupByKeys = new[]
                {
                    "ibm.logId",
                },
            },
            PhantomMode = false,
            Priority = "p5_or_unspecified",
            Region = "eu-gb",
            Type = "logs_new_value",
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsNewValueArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsNewValueLogsFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var newValue = new LogsAlertDefinition("newValue", LogsAlertDefinitionArgs.builder()
                .enabled(true)
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(720)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .logsNewValue(LogsAlertDefinitionLogsNewValueArgs.builder()
                    .logsFilter(LogsAlertDefinitionLogsNewValueLogsFilterArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterArgs.builder()
                            .luceneQuery("text")
                            .build())
                        .build())
                    .notificationPayloadFilters()
                    .rules(LogsAlertDefinitionLogsNewValueRuleArgs.builder()
                        .condition(LogsAlertDefinitionLogsNewValueRuleConditionArgs.builder()
                            .keypathToTrack("ibm.logId")
                            .timeWindow(LogsAlertDefinitionLogsNewValueRuleConditionTimeWindowArgs.builder()
                                .logsNewValueTimeWindowSpecificValue("hours_12_or_unspecified")
                                .build())
                            .build())
                        .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .groupByKeys("ibm.logId")
                    .build())
                .phantomMode(false)
                .priority("p5_or_unspecified")
                .region("eu-gb")
                .type("logs_new_value")
                .build());
    
        }
    }
    
    resources:
      newValue:
        type: ibm:LogsAlertDefinition
        properties:
          enabled: true
          incidentsSettings:
            minutes: 720
            notifyOn: triggered_only_unspecified
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          logsNewValue:
            logsFilter:
              simpleFilter:
                luceneQuery: text
            notificationPayloadFilters: []
            rules:
              - condition:
                  keypathToTrack: ibm.logId
                  timeWindow:
                    logsNewValueTimeWindowSpecificValue: hours_12_or_unspecified
          notificationGroup:
            groupByKeys:
              - ibm.logId
          phantomMode: false
          priority: p5_or_unspecified
          region: eu-gb
          type: logs_new_value
    

    Metric less than or equals alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const metricAlertLessThanOrEquals = new ibm.LogsAlertDefinition("metricAlertLessThanOrEquals", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p2",
        type: "metric_threshold",
        incidentsSettings: {
            minutes: 10,
            notifyOn: "triggered_and_resolved",
        },
        metricThreshold: {
            conditionType: "less_than_or_equals",
            evaluationDelayMs: 0,
            metricFilter: {
                promql: "duration_cx_sum",
            },
            missingValues: {
                replaceWithZero: true,
            },
            rules: [{
                condition: {
                    forOverPct: 0,
                    threshold: 1,
                    ofTheLast: {
                        metricTimeWindowSpecificValue: "minutes_10",
                    },
                },
                override: {
                    priority: "p2",
                },
            }],
            undetectedValuesManagement: {
                autoRetireTimeframe: "never_or_unspecified",
                triggerUndetectedValues: false,
            },
        },
        notificationGroup: {
            groupByKeys: [],
            webhooks: [{
                minutes: 0,
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    metric_alert_less_than_or_equals = ibm.LogsAlertDefinition("metricAlertLessThanOrEquals",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p2",
        type="metric_threshold",
        incidents_settings={
            "minutes": 10,
            "notify_on": "triggered_and_resolved",
        },
        metric_threshold={
            "condition_type": "less_than_or_equals",
            "evaluation_delay_ms": 0,
            "metric_filter": {
                "promql": "duration_cx_sum",
            },
            "missing_values": {
                "replace_with_zero": True,
            },
            "rules": [{
                "condition": {
                    "for_over_pct": 0,
                    "threshold": 1,
                    "of_the_last": {
                        "metric_time_window_specific_value": "minutes_10",
                    },
                },
                "override": {
                    "priority": "p2",
                },
            }],
            "undetected_values_management": {
                "auto_retire_timeframe": "never_or_unspecified",
                "trigger_undetected_values": False,
            },
        },
        notification_group={
            "group_by_keys": [],
            "webhooks": [{
                "minutes": 0,
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "metricAlertLessThanOrEquals", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p2"),
    			Type:        pulumi.String("metric_threshold"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(10),
    				NotifyOn: pulumi.String("triggered_and_resolved"),
    			},
    			MetricThreshold: &ibm.LogsAlertDefinitionMetricThresholdArgs{
    				ConditionType:     pulumi.String("less_than_or_equals"),
    				EvaluationDelayMs: pulumi.Float64(0),
    				MetricFilter: &ibm.LogsAlertDefinitionMetricThresholdMetricFilterArgs{
    					Promql: pulumi.String("duration_cx_sum"),
    				},
    				MissingValues: &ibm.LogsAlertDefinitionMetricThresholdMissingValuesArgs{
    					ReplaceWithZero: pulumi.Bool(true),
    				},
    				Rules: ibm.LogsAlertDefinitionMetricThresholdRuleArray{
    					&ibm.LogsAlertDefinitionMetricThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionMetricThresholdRuleConditionArgs{
    							ForOverPct: pulumi.Float64(0),
    							Threshold:  pulumi.Float64(1),
    							OfTheLast: &ibm.LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs{
    								MetricTimeWindowSpecificValue: pulumi.String("minutes_10"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionMetricThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p2"),
    						},
    					},
    				},
    				UndetectedValuesManagement: &ibm.LogsAlertDefinitionMetricThresholdUndetectedValuesManagementArgs{
    					AutoRetireTimeframe:     pulumi.String("never_or_unspecified"),
    					TriggerUndetectedValues: pulumi.Bool(false),
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				GroupByKeys: pulumi.StringArray{},
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Minutes: pulumi.Float64(0),
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var metricAlertLessThanOrEquals = new Ibm.LogsAlertDefinition("metricAlertLessThanOrEquals", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p2",
            Type = "metric_threshold",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 10,
                NotifyOn = "triggered_and_resolved",
            },
            MetricThreshold = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdArgs
            {
                ConditionType = "less_than_or_equals",
                EvaluationDelayMs = 0,
                MetricFilter = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdMetricFilterArgs
                {
                    Promql = "duration_cx_sum",
                },
                MissingValues = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdMissingValuesArgs
                {
                    ReplaceWithZero = true,
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleConditionArgs
                        {
                            ForOverPct = 0,
                            Threshold = 1,
                            OfTheLast = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs
                            {
                                MetricTimeWindowSpecificValue = "minutes_10",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleOverrideArgs
                        {
                            Priority = "p2",
                        },
                    },
                },
                UndetectedValuesManagement = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdUndetectedValuesManagementArgs
                {
                    AutoRetireTimeframe = "never_or_unspecified",
                    TriggerUndetectedValues = false,
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                GroupByKeys = new() { },
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Minutes = 0,
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionMetricThresholdArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionMetricThresholdMetricFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionMetricThresholdMissingValuesArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionMetricThresholdUndetectedValuesManagementArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var metricAlertLessThanOrEquals = new LogsAlertDefinition("metricAlertLessThanOrEquals", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p2")
                .type("metric_threshold")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(10)
                    .notifyOn("triggered_and_resolved")
                    .build())
                .metricThreshold(LogsAlertDefinitionMetricThresholdArgs.builder()
                    .conditionType("less_than_or_equals")
                    .evaluationDelayMs(0)
                    .metricFilter(LogsAlertDefinitionMetricThresholdMetricFilterArgs.builder()
                        .promql("duration_cx_sum")
                        .build())
                    .missingValues(LogsAlertDefinitionMetricThresholdMissingValuesArgs.builder()
                        .replaceWithZero(true)
                        .build())
                    .rules(LogsAlertDefinitionMetricThresholdRuleArgs.builder()
                        .condition(LogsAlertDefinitionMetricThresholdRuleConditionArgs.builder()
                            .forOverPct(0)
                            .threshold(1)
                            .ofTheLast(LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs.builder()
                                .metricTimeWindowSpecificValue("minutes_10")
                                .build())
                            .build())
                        .override(LogsAlertDefinitionMetricThresholdRuleOverrideArgs.builder()
                            .priority("p2")
                            .build())
                        .build())
                    .undetectedValuesManagement(LogsAlertDefinitionMetricThresholdUndetectedValuesManagementArgs.builder()
                        .autoRetireTimeframe("never_or_unspecified")
                        .triggerUndetectedValues(false)
                        .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .groupByKeys()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .minutes(0)
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      metricAlertLessThanOrEquals:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p2
          type: metric_threshold
          incidentsSettings:
            minutes: 10
            notifyOn: triggered_and_resolved
          metricThreshold:
            conditionType: less_than_or_equals
            evaluationDelayMs: 0
            metricFilter:
              promql: duration_cx_sum
            missingValues:
              replaceWithZero: true
            rules:
              - condition:
                  forOverPct: 0
                  threshold: 1
                  ofTheLast:
                    metricTimeWindowSpecificValue: minutes_10
                override:
                  priority: p2
            undetectedValuesManagement:
              autoRetireTimeframe: never_or_unspecified
              triggerUndetectedValues: false
          notificationGroup:
            groupByKeys: []
            webhooks:
              - minutes: 0
                integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    Metric more than or equals alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    const metricMoreThanOrEqualsWithUsage = new ibm.LogsAlertDefinition("metricMoreThanOrEqualsWithUsage", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p1",
        type: "metric_threshold",
        incidentsSettings: {
            minutes: 10,
            notifyOn: "triggered_only_unspecified",
        },
        metricThreshold: {
            conditionType: "more_than_or_equals",
            evaluationDelayMs: 0,
            metricFilter: {
                promql: "cx_data_usage_bytes_total",
            },
            missingValues: {
                minNonNullValuesPct: 100,
            },
            rules: [{
                condition: {
                    forOverPct: 0,
                    threshold: 1,
                    ofTheLast: {
                        metricTimeWindowSpecificValue: "minutes_10",
                    },
                },
                override: {
                    priority: "p1",
                },
            }],
        },
        notificationGroup: {
            groupByKeys: [],
            webhooks: [{
                minutes: 0,
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    metric_more_than_or_equals_with_usage = ibm.LogsAlertDefinition("metricMoreThanOrEqualsWithUsage",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p1",
        type="metric_threshold",
        incidents_settings={
            "minutes": 10,
            "notify_on": "triggered_only_unspecified",
        },
        metric_threshold={
            "condition_type": "more_than_or_equals",
            "evaluation_delay_ms": 0,
            "metric_filter": {
                "promql": "cx_data_usage_bytes_total",
            },
            "missing_values": {
                "min_non_null_values_pct": 100,
            },
            "rules": [{
                "condition": {
                    "for_over_pct": 0,
                    "threshold": 1,
                    "of_the_last": {
                        "metric_time_window_specific_value": "minutes_10",
                    },
                },
                "override": {
                    "priority": "p1",
                },
            }],
        },
        notification_group={
            "group_by_keys": [],
            "webhooks": [{
                "minutes": 0,
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		_, err := ibm.NewLogsAlertDefinition(ctx, "metricMoreThanOrEqualsWithUsage", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p1"),
    			Type:        pulumi.String("metric_threshold"),
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(10),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			MetricThreshold: &ibm.LogsAlertDefinitionMetricThresholdArgs{
    				ConditionType:     pulumi.String("more_than_or_equals"),
    				EvaluationDelayMs: pulumi.Float64(0),
    				MetricFilter: &ibm.LogsAlertDefinitionMetricThresholdMetricFilterArgs{
    					Promql: pulumi.String("cx_data_usage_bytes_total"),
    				},
    				MissingValues: &ibm.LogsAlertDefinitionMetricThresholdMissingValuesArgs{
    					MinNonNullValuesPct: pulumi.Float64(100),
    				},
    				Rules: ibm.LogsAlertDefinitionMetricThresholdRuleArray{
    					&ibm.LogsAlertDefinitionMetricThresholdRuleArgs{
    						Condition: &ibm.LogsAlertDefinitionMetricThresholdRuleConditionArgs{
    							ForOverPct: pulumi.Float64(0),
    							Threshold:  pulumi.Float64(1),
    							OfTheLast: &ibm.LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs{
    								MetricTimeWindowSpecificValue: pulumi.String("minutes_10"),
    							},
    						},
    						Override: &ibm.LogsAlertDefinitionMetricThresholdRuleOverrideArgs{
    							Priority: pulumi.String("p1"),
    						},
    					},
    				},
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				GroupByKeys: pulumi.StringArray{},
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Minutes: pulumi.Float64(0),
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        var metricMoreThanOrEqualsWithUsage = new Ibm.LogsAlertDefinition("metricMoreThanOrEqualsWithUsage", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p1",
            Type = "metric_threshold",
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 10,
                NotifyOn = "triggered_only_unspecified",
            },
            MetricThreshold = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdArgs
            {
                ConditionType = "more_than_or_equals",
                EvaluationDelayMs = 0,
                MetricFilter = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdMetricFilterArgs
                {
                    Promql = "cx_data_usage_bytes_total",
                },
                MissingValues = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdMissingValuesArgs
                {
                    MinNonNullValuesPct = 100,
                },
                Rules = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleArgs
                    {
                        Condition = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleConditionArgs
                        {
                            ForOverPct = 0,
                            Threshold = 1,
                            OfTheLast = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs
                            {
                                MetricTimeWindowSpecificValue = "minutes_10",
                            },
                        },
                        Override = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleOverrideArgs
                        {
                            Priority = "p1",
                        },
                    },
                },
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                GroupByKeys = new() { },
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Minutes = 0,
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionMetricThresholdArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionMetricThresholdMetricFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionMetricThresholdMissingValuesArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            var metricMoreThanOrEqualsWithUsage = new LogsAlertDefinition("metricMoreThanOrEqualsWithUsage", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p1")
                .type("metric_threshold")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(10)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .metricThreshold(LogsAlertDefinitionMetricThresholdArgs.builder()
                    .conditionType("more_than_or_equals")
                    .evaluationDelayMs(0)
                    .metricFilter(LogsAlertDefinitionMetricThresholdMetricFilterArgs.builder()
                        .promql("cx_data_usage_bytes_total")
                        .build())
                    .missingValues(LogsAlertDefinitionMetricThresholdMissingValuesArgs.builder()
                        .minNonNullValuesPct(100)
                        .build())
                    .rules(LogsAlertDefinitionMetricThresholdRuleArgs.builder()
                        .condition(LogsAlertDefinitionMetricThresholdRuleConditionArgs.builder()
                            .forOverPct(0)
                            .threshold(1)
                            .ofTheLast(LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs.builder()
                                .metricTimeWindowSpecificValue("minutes_10")
                                .build())
                            .build())
                        .override(LogsAlertDefinitionMetricThresholdRuleOverrideArgs.builder()
                            .priority("p1")
                            .build())
                        .build())
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .groupByKeys()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .minutes(0)
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      metricMoreThanOrEqualsWithUsage:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p1
          type: metric_threshold
          incidentsSettings:
            minutes: 10
            notifyOn: triggered_only_unspecified
          metricThreshold:
            conditionType: more_than_or_equals
            evaluationDelayMs: 0
            metricFilter:
              promql: cx_data_usage_bytes_total
            missingValues:
              minNonNullValuesPct: 100
            rules:
              - condition:
                  forOverPct: 0
                  threshold: 1
                  ofTheLast:
                    metricTimeWindowSpecificValue: minutes_10
                override:
                  priority: p1
          notificationGroup:
            groupByKeys: []
            webhooks:
              - minutes: 0
                integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    Flow alert

    import * as pulumi from "@pulumi/pulumi";
    import * as ibm from "@pulumi/ibm";
    
    // ibm_logs_alert_definition.flow_alert:
    const flowAlert = new ibm.LogsAlertDefinition("flowAlert", {
        instanceId: "470e285d-3354-44f8-8119-c91902d23",
        region: "eu-gb",
        enabled: true,
        phantomMode: false,
        priority: "p1",
        type: "flow",
        flow: {
            enforceSuppression: false,
            stages: [
                {
                    timeframeMs: "0",
                    timeframeType: "up_to",
                    flowStagesGroups: {
                        groups: [{
                            alertsOp: "or",
                            nextOp: "and_or_unspecified",
                            alertDefs: [
                                {
                                    id: ibm_logs_alert_definition.standard_less_than_threshold.alert_def_id,
                                    not: false,
                                },
                                {
                                    id: ibm_logs_alert_definition.standard_immediate.alert_def_id,
                                    not: false,
                                },
                            ],
                        }],
                    },
                },
                {
                    timeframeMs: "3600000",
                    timeframeType: "up_to",
                    flowStagesGroups: {
                        groups: [{
                            alertsOp: "and_or_unspecified",
                            nextOp: "and_or_unspecified",
                            alertDefs: [{
                                id: ibm_logs_alert_definition.new_value.alert_def_id,
                                not: false,
                            }],
                        }],
                    },
                },
            ],
        },
        incidentsSettings: {
            minutes: 10,
            notifyOn: "triggered_only_unspecified",
        },
        notificationGroup: {
            webhooks: [{
                integration: {
                    integrationId: data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id,
                },
            }],
        },
    });
    
    import pulumi
    import pulumi_ibm as ibm
    
    # ibm_logs_alert_definition.flow_alert:
    flow_alert = ibm.LogsAlertDefinition("flowAlert",
        instance_id="470e285d-3354-44f8-8119-c91902d23",
        region="eu-gb",
        enabled=True,
        phantom_mode=False,
        priority="p1",
        type="flow",
        flow={
            "enforce_suppression": False,
            "stages": [
                {
                    "timeframe_ms": "0",
                    "timeframe_type": "up_to",
                    "flow_stages_groups": {
                        "groups": [{
                            "alerts_op": "or",
                            "next_op": "and_or_unspecified",
                            "alert_defs": [
                                {
                                    "id": ibm_logs_alert_definition["standard_less_than_threshold"]["alert_def_id"],
                                    "not_": False,
                                },
                                {
                                    "id": ibm_logs_alert_definition["standard_immediate"]["alert_def_id"],
                                    "not_": False,
                                },
                            ],
                        }],
                    },
                },
                {
                    "timeframe_ms": "3600000",
                    "timeframe_type": "up_to",
                    "flow_stages_groups": {
                        "groups": [{
                            "alerts_op": "and_or_unspecified",
                            "next_op": "and_or_unspecified",
                            "alert_defs": [{
                                "id": ibm_logs_alert_definition["new_value"]["alert_def_id"],
                                "not_": False,
                            }],
                        }],
                    },
                },
            ],
        },
        incidents_settings={
            "minutes": 10,
            "notify_on": "triggered_only_unspecified",
        },
        notification_group={
            "webhooks": [{
                "integration": {
                    "integration_id": data["ibm_logs_outgoing_webhook"]["logs_outgoing_webhook_instance"]["external_id"],
                },
            }],
        })
    
    package main
    
    import (
    	"github.com/pulumi/pulumi-terraform-provider/sdks/go/ibm/ibm"
    	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
    )
    
    func main() {
    	pulumi.Run(func(ctx *pulumi.Context) error {
    		// ibm_logs_alert_definition.flow_alert:
    		_, err := ibm.NewLogsAlertDefinition(ctx, "flowAlert", &ibm.LogsAlertDefinitionArgs{
    			InstanceId:  pulumi.String("470e285d-3354-44f8-8119-c91902d23"),
    			Region:      pulumi.String("eu-gb"),
    			Enabled:     pulumi.Bool(true),
    			PhantomMode: pulumi.Bool(false),
    			Priority:    pulumi.String("p1"),
    			Type:        pulumi.String("flow"),
    			Flow: &ibm.LogsAlertDefinitionFlowArgs{
    				EnforceSuppression: pulumi.Bool(false),
    				Stages: ibm.LogsAlertDefinitionFlowStageArray{
    					&ibm.LogsAlertDefinitionFlowStageArgs{
    						TimeframeMs:   pulumi.String("0"),
    						TimeframeType: pulumi.String("up_to"),
    						FlowStagesGroups: &ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsArgs{
    							Groups: ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArray{
    								&ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs{
    									AlertsOp: pulumi.String("or"),
    									NextOp:   pulumi.String("and_or_unspecified"),
    									AlertDefs: ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArray{
    										&ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs{
    											Id:  pulumi.Any(ibm_logs_alert_definition.Standard_less_than_threshold.Alert_def_id),
    											Not: pulumi.Bool(false),
    										},
    										&ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs{
    											Id:  pulumi.Any(ibm_logs_alert_definition.Standard_immediate.Alert_def_id),
    											Not: pulumi.Bool(false),
    										},
    									},
    								},
    							},
    						},
    					},
    					&ibm.LogsAlertDefinitionFlowStageArgs{
    						TimeframeMs:   pulumi.String("3600000"),
    						TimeframeType: pulumi.String("up_to"),
    						FlowStagesGroups: &ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsArgs{
    							Groups: ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArray{
    								&ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs{
    									AlertsOp: pulumi.String("and_or_unspecified"),
    									NextOp:   pulumi.String("and_or_unspecified"),
    									AlertDefs: ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArray{
    										&ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs{
    											Id:  pulumi.Any(ibm_logs_alert_definition.New_value.Alert_def_id),
    											Not: pulumi.Bool(false),
    										},
    									},
    								},
    							},
    						},
    					},
    				},
    			},
    			IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    				Minutes:  pulumi.Float64(10),
    				NotifyOn: pulumi.String("triggered_only_unspecified"),
    			},
    			NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    				Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    					&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    						Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    							IntegrationId: pulumi.Any(data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id),
    						},
    					},
    				},
    			},
    		})
    		if err != nil {
    			return err
    		}
    		return nil
    	})
    }
    
    using System.Collections.Generic;
    using System.Linq;
    using Pulumi;
    using Ibm = Pulumi.Ibm;
    
    return await Deployment.RunAsync(() => 
    {
        // ibm_logs_alert_definition.flow_alert:
        var flowAlert = new Ibm.LogsAlertDefinition("flowAlert", new()
        {
            InstanceId = "470e285d-3354-44f8-8119-c91902d23",
            Region = "eu-gb",
            Enabled = true,
            PhantomMode = false,
            Priority = "p1",
            Type = "flow",
            Flow = new Ibm.Inputs.LogsAlertDefinitionFlowArgs
            {
                EnforceSuppression = false,
                Stages = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionFlowStageArgs
                    {
                        TimeframeMs = "0",
                        TimeframeType = "up_to",
                        FlowStagesGroups = new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsArgs
                        {
                            Groups = new[]
                            {
                                new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs
                                {
                                    AlertsOp = "or",
                                    NextOp = "and_or_unspecified",
                                    AlertDefs = new[]
                                    {
                                        new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs
                                        {
                                            Id = ibm_logs_alert_definition.Standard_less_than_threshold.Alert_def_id,
                                            Not = false,
                                        },
                                        new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs
                                        {
                                            Id = ibm_logs_alert_definition.Standard_immediate.Alert_def_id,
                                            Not = false,
                                        },
                                    },
                                },
                            },
                        },
                    },
                    new Ibm.Inputs.LogsAlertDefinitionFlowStageArgs
                    {
                        TimeframeMs = "3600000",
                        TimeframeType = "up_to",
                        FlowStagesGroups = new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsArgs
                        {
                            Groups = new[]
                            {
                                new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs
                                {
                                    AlertsOp = "and_or_unspecified",
                                    NextOp = "and_or_unspecified",
                                    AlertDefs = new[]
                                    {
                                        new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs
                                        {
                                            Id = ibm_logs_alert_definition.New_value.Alert_def_id,
                                            Not = false,
                                        },
                                    },
                                },
                            },
                        },
                    },
                },
            },
            IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
            {
                Minutes = 10,
                NotifyOn = "triggered_only_unspecified",
            },
            NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
            {
                Webhooks = new[]
                {
                    new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                    {
                        Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                        {
                            IntegrationId = data.Ibm_logs_outgoing_webhook.Logs_outgoing_webhook_instance.External_id,
                        },
                    },
                },
            },
        });
    
    });
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionFlowArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            // ibm_logs_alert_definition.flow_alert:
            var flowAlert = new LogsAlertDefinition("flowAlert", LogsAlertDefinitionArgs.builder()
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .region("eu-gb")
                .enabled(true)
                .phantomMode(false)
                .priority("p1")
                .type("flow")
                .flow(LogsAlertDefinitionFlowArgs.builder()
                    .enforceSuppression(false)
                    .stages(                
                        LogsAlertDefinitionFlowStageArgs.builder()
                            .timeframeMs("0")
                            .timeframeType("up_to")
                            .flowStagesGroups(LogsAlertDefinitionFlowStageFlowStagesGroupsArgs.builder()
                                .groups(LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs.builder()
                                    .alertsOp("or")
                                    .nextOp("and_or_unspecified")
                                    .alertDefs(                                
                                        LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs.builder()
                                            .id(ibm_logs_alert_definition.standard_less_than_threshold().alert_def_id())
                                            .not(false)
                                            .build(),
                                        LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs.builder()
                                            .id(ibm_logs_alert_definition.standard_immediate().alert_def_id())
                                            .not(false)
                                            .build())
                                    .build())
                                .build())
                            .build(),
                        LogsAlertDefinitionFlowStageArgs.builder()
                            .timeframeMs("3600000")
                            .timeframeType("up_to")
                            .flowStagesGroups(LogsAlertDefinitionFlowStageFlowStagesGroupsArgs.builder()
                                .groups(LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs.builder()
                                    .alertsOp("and_or_unspecified")
                                    .nextOp("and_or_unspecified")
                                    .alertDefs(LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs.builder()
                                        .id(ibm_logs_alert_definition.new_value().alert_def_id())
                                        .not(false)
                                        .build())
                                    .build())
                                .build())
                            .build())
                    .build())
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(10)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                        .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                            .integrationId(data.ibm_logs_outgoing_webhook().logs_outgoing_webhook_instance().external_id())
                            .build())
                        .build())
                    .build())
                .build());
    
        }
    }
    
    resources:
      # ibm_logs_alert_definition.flow_alert:
      flowAlert:
        type: ibm:LogsAlertDefinition
        properties:
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          region: eu-gb
          enabled: true
          phantomMode: false
          priority: p1
          type: flow
          flow:
            enforceSuppression: false
            stages:
              - timeframeMs: '0'
                timeframeType: up_to
                flowStagesGroups:
                  groups:
                    - alertsOp: or
                      nextOp: and_or_unspecified
                      alertDefs:
                        - id: ${ibm_logs_alert_definition.standard_less_than_threshold.alert_def_id}
                          not: false
                        - id: ${ibm_logs_alert_definition.standard_immediate.alert_def_id}
                          not: false
              - timeframeMs: '3600000'
                timeframeType: up_to
                flowStagesGroups:
                  groups:
                    - alertsOp: and_or_unspecified
                      nextOp: and_or_unspecified
                      alertDefs:
                        - id: ${ibm_logs_alert_definition.new_value.alert_def_id}
                          not: false
          incidentsSettings:
            minutes: 10
            notifyOn: triggered_only_unspecified
          notificationGroup:
            webhooks:
              - integration:
                  integrationId: ${data.ibm_logs_outgoing_webhook.logs_outgoing_webhook_instance.external_id}
    

    Unique count alert

    Example coming soon!
    
    Example coming soon!
    
    Example coming soon!
    
    Example coming soon!
    
    package generated_program;
    
    import com.pulumi.Context;
    import com.pulumi.Pulumi;
    import com.pulumi.core.Output;
    import com.pulumi.ibm.LogsAlertDefinition;
    import com.pulumi.ibm.LogsAlertDefinitionArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionIncidentsSettingsArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsUniqueCountArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsUniqueCountLogsFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersArgs;
    import com.pulumi.ibm.inputs.LogsAlertDefinitionNotificationGroupArgs;
    import java.util.List;
    import java.util.ArrayList;
    import java.util.Map;
    import java.io.File;
    import java.nio.file.Files;
    import java.nio.file.Paths;
    
    public class App {
        public static void main(String[] args) {
            Pulumi.run(App::stack);
        }
    
        public static void stack(Context ctx) {
            // ibm_logs_alert_definition.unique_count:
            var uniqueCount = new LogsAlertDefinition("uniqueCount", LogsAlertDefinitionArgs.builder()
                .enabled(true)
                .groupByKeys("coralogix.logId")
                .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
                    .minutes(5)
                    .notifyOn("triggered_only_unspecified")
                    .build())
                .instanceId("470e285d-3354-44f8-8119-c91902d23")
                .logsUniqueCount(LogsAlertDefinitionLogsUniqueCountArgs.builder()
                    .logsFilter(LogsAlertDefinitionLogsUniqueCountLogsFilterArgs.builder()
                        .simpleFilter(LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterArgs.builder()
                            .labelFilters(LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersArgs.builder()
                                .applicationName(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                                .severities()
                                .subsystemName(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                                .build())
                            .luceneQuery("\"push\"")
                            .build())
                        .build())
                    .maxUniqueCountPerGroupByKey("10")
                    .notificationPayloadFilters()
                    .rules(LogsAlertDefinitionLogsUniqueCountRuleArgs.builder()
                        .condition(LogsAlertDefinitionLogsUniqueCountRuleConditionArgs.builder()
                            .maxUniqueCount("0")
                            .timeWindow(LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindowArgs.builder()
                                .logsUniqueValueTimeWindowSpecificValue("minute_1_or_unspecified")
                                .build())
                            .build())
                        .build())
                    .uniqueCountKeypath("text")
                    .build())
                .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
                    .groupByKeys("coralogix.logId")
                    .build())
                .phantomMode(false)
                .priority("p1")
                .region("eu-gb")
                .type("logs_unique_count")
                .build());
    
        }
    }
    
    resources:
      # ibm_logs_alert_definition.unique_count:
      uniqueCount:
        type: ibm:LogsAlertDefinition
        properties:
          enabled: true
          groupByKeys:
            - coralogix.logId
          incidentsSettings:
            minutes: 5
            notifyOn: triggered_only_unspecified
          instanceId: 470e285d-3354-44f8-8119-c91902d23
          logsUniqueCount:
            logsFilter:
              simpleFilter:
                labelFilters:
                  applicationName:
                    - operation: is_or_unspecified
                      value: sev1
                  severities: []
                  subsystemName:
                    - operation: is_or_unspecified
                      value: sev1-logs
                luceneQuery: '"push"'
            maxUniqueCountPerGroupByKey: '10'
            notificationPayloadFilters: []
            rules:
              - condition:
                  maxUniqueCount: '0'
                  timeWindow:
                    logsUniqueValueTimeWindowSpecificValue: minute_1_or_unspecified
            uniqueCountKeypath: text
          notificationGroup:
            groupByKeys:
              - coralogix.logId
          phantomMode: false
          priority: p1
          region: eu-gb
          type: logs_unique_count
    

    Create LogsAlertDefinition Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new LogsAlertDefinition(name: string, args: LogsAlertDefinitionArgs, opts?: CustomResourceOptions);
    @overload
    def LogsAlertDefinition(resource_name: str,
                            args: LogsAlertDefinitionArgs,
                            opts: Optional[ResourceOptions] = None)
    
    @overload
    def LogsAlertDefinition(resource_name: str,
                            opts: Optional[ResourceOptions] = None,
                            instance_id: Optional[str] = None,
                            type: Optional[str] = None,
                            logs_immediate: Optional[LogsAlertDefinitionLogsImmediateArgs] = None,
                            incidents_settings: Optional[LogsAlertDefinitionIncidentsSettingsArgs] = None,
                            endpoint_type: Optional[str] = None,
                            entity_labels: Optional[Mapping[str, str]] = None,
                            flow: Optional[LogsAlertDefinitionFlowArgs] = None,
                            group_by_keys: Optional[Sequence[str]] = None,
                            logs_new_value: Optional[LogsAlertDefinitionLogsNewValueArgs] = None,
                            description: Optional[str] = None,
                            logs_alert_definition_id: Optional[str] = None,
                            logs_anomaly: Optional[LogsAlertDefinitionLogsAnomalyArgs] = None,
                            enabled: Optional[bool] = None,
                            active_on: Optional[LogsAlertDefinitionActiveOnArgs] = None,
                            metric_anomaly: Optional[LogsAlertDefinitionMetricAnomalyArgs] = None,
                            logs_threshold: Optional[LogsAlertDefinitionLogsThresholdArgs] = None,
                            logs_time_relative_threshold: Optional[LogsAlertDefinitionLogsTimeRelativeThresholdArgs] = None,
                            logs_unique_count: Optional[LogsAlertDefinitionLogsUniqueCountArgs] = None,
                            logs_ratio_threshold: Optional[LogsAlertDefinitionLogsRatioThresholdArgs] = None,
                            metric_threshold: Optional[LogsAlertDefinitionMetricThresholdArgs] = None,
                            name: Optional[str] = None,
                            notification_group: Optional[LogsAlertDefinitionNotificationGroupArgs] = None,
                            phantom_mode: Optional[bool] = None,
                            priority: Optional[str] = None,
                            region: Optional[str] = None,
                            deleted: Optional[bool] = None)
    func NewLogsAlertDefinition(ctx *Context, name string, args LogsAlertDefinitionArgs, opts ...ResourceOption) (*LogsAlertDefinition, error)
    public LogsAlertDefinition(string name, LogsAlertDefinitionArgs args, CustomResourceOptions? opts = null)
    public LogsAlertDefinition(String name, LogsAlertDefinitionArgs args)
    public LogsAlertDefinition(String name, LogsAlertDefinitionArgs args, CustomResourceOptions options)
    
    type: ibm:LogsAlertDefinition
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    

    Parameters

    name string
    The unique name of the resource.
    args LogsAlertDefinitionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args LogsAlertDefinitionArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args LogsAlertDefinitionArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args LogsAlertDefinitionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args LogsAlertDefinitionArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var logsAlertDefinitionResource = new Ibm.LogsAlertDefinition("logsAlertDefinitionResource", new()
    {
        InstanceId = "string",
        Type = "string",
        LogsImmediate = new Ibm.Inputs.LogsAlertDefinitionLogsImmediateArgs
        {
            LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsImmediateLogsFilterArgs
            {
                SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterArgs
                {
                    LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersArgs
                    {
                        ApplicationNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                        Severities = new[]
                        {
                            "string",
                        },
                        SubsystemNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                    },
                    LuceneQuery = "string",
                },
            },
            NotificationPayloadFilters = new[]
            {
                "string",
            },
        },
        IncidentsSettings = new Ibm.Inputs.LogsAlertDefinitionIncidentsSettingsArgs
        {
            Minutes = 0,
            NotifyOn = "string",
        },
        EndpointType = "string",
        EntityLabels = 
        {
            { "string", "string" },
        },
        Flow = new Ibm.Inputs.LogsAlertDefinitionFlowArgs
        {
            Stages = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionFlowStageArgs
                {
                    FlowStagesGroups = new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsArgs
                    {
                        Groups = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs
                            {
                                AlertDefs = new[]
                                {
                                    new Ibm.Inputs.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs
                                    {
                                        Id = "string",
                                        Not = false,
                                    },
                                },
                                AlertsOp = "string",
                                NextOp = "string",
                            },
                        },
                    },
                    TimeframeMs = "string",
                    TimeframeType = "string",
                },
            },
            EnforceSuppression = false,
        },
        GroupByKeys = new[]
        {
            "string",
        },
        LogsNewValue = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueArgs
        {
            Rules = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionLogsNewValueRuleArgs
                {
                    Condition = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueRuleConditionArgs
                    {
                        KeypathToTrack = "string",
                        TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueRuleConditionTimeWindowArgs
                        {
                            LogsNewValueTimeWindowSpecificValue = "string",
                        },
                    },
                },
            },
            LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueLogsFilterArgs
            {
                SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterArgs
                {
                    LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersArgs
                    {
                        ApplicationNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                        Severities = new[]
                        {
                            "string",
                        },
                        SubsystemNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                    },
                    LuceneQuery = "string",
                },
            },
            NotificationPayloadFilters = new[]
            {
                "string",
            },
        },
        Description = "string",
        LogsAlertDefinitionId = "string",
        LogsAnomaly = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyArgs
        {
            ConditionType = "string",
            Rules = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyRuleArgs
                {
                    Condition = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyRuleConditionArgs
                    {
                        MinimumThreshold = 0,
                        TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindowArgs
                        {
                            LogsTimeWindowSpecificValue = "string",
                        },
                    },
                },
            },
            AnomalyAlertSettings = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyAnomalyAlertSettingsArgs
            {
                PercentageOfDeviation = 0,
            },
            EvaluationDelayMs = 0,
            LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterArgs
            {
                SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterArgs
                {
                    LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersArgs
                    {
                        ApplicationNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                        Severities = new[]
                        {
                            "string",
                        },
                        SubsystemNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                    },
                    LuceneQuery = "string",
                },
            },
            NotificationPayloadFilters = new[]
            {
                "string",
            },
        },
        Enabled = false,
        ActiveOn = new Ibm.Inputs.LogsAlertDefinitionActiveOnArgs
        {
            DayOfWeeks = new[]
            {
                "string",
            },
            EndTime = new Ibm.Inputs.LogsAlertDefinitionActiveOnEndTimeArgs
            {
                Hours = 0,
                Minutes = 0,
            },
            StartTime = new Ibm.Inputs.LogsAlertDefinitionActiveOnStartTimeArgs
            {
                Hours = 0,
                Minutes = 0,
            },
        },
        MetricAnomaly = new Ibm.Inputs.LogsAlertDefinitionMetricAnomalyArgs
        {
            ConditionType = "string",
            MetricFilter = new Ibm.Inputs.LogsAlertDefinitionMetricAnomalyMetricFilterArgs
            {
                Promql = "string",
            },
            Rules = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionMetricAnomalyRuleArgs
                {
                    Condition = new Ibm.Inputs.LogsAlertDefinitionMetricAnomalyRuleConditionArgs
                    {
                        MinNonNullValuesPct = 0,
                        OfTheLast = new Ibm.Inputs.LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLastArgs
                        {
                            MetricTimeWindowDynamicDuration = "string",
                            MetricTimeWindowSpecificValue = "string",
                        },
                        Threshold = 0,
                        ForOverPct = 0,
                    },
                },
            },
            AnomalyAlertSettings = new Ibm.Inputs.LogsAlertDefinitionMetricAnomalyAnomalyAlertSettingsArgs
            {
                PercentageOfDeviation = 0,
            },
            EvaluationDelayMs = 0,
        },
        LogsThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdArgs
        {
            ConditionType = "string",
            Rules = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleArgs
                {
                    Condition = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionArgs
                    {
                        Threshold = 0,
                        TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs
                        {
                            LogsTimeWindowSpecificValue = "string",
                        },
                    },
                    Override = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdRuleOverrideArgs
                    {
                        Priority = "string",
                    },
                },
            },
            EvaluationDelayMs = 0,
            LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterArgs
            {
                SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs
                {
                    LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs
                    {
                        ApplicationNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                        Severities = new[]
                        {
                            "string",
                        },
                        SubsystemNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                    },
                    LuceneQuery = "string",
                },
            },
            NotificationPayloadFilters = new[]
            {
                "string",
            },
            UndetectedValuesManagement = new Ibm.Inputs.LogsAlertDefinitionLogsThresholdUndetectedValuesManagementArgs
            {
                AutoRetireTimeframe = "string",
                TriggerUndetectedValues = false,
            },
        },
        LogsTimeRelativeThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdArgs
        {
            ConditionType = "string",
            Rules = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs
                {
                    Condition = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs
                    {
                        ComparedTo = "string",
                        Threshold = 0,
                    },
                    Override = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs
                    {
                        Priority = "string",
                    },
                },
            },
            EvaluationDelayMs = 0,
            IgnoreInfinity = false,
            LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs
            {
                SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs
                {
                    LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersArgs
                    {
                        ApplicationNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                        Severities = new[]
                        {
                            "string",
                        },
                        SubsystemNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                    },
                    LuceneQuery = "string",
                },
            },
            NotificationPayloadFilters = new[]
            {
                "string",
            },
            UndetectedValuesManagement = new Ibm.Inputs.LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagementArgs
            {
                AutoRetireTimeframe = "string",
                TriggerUndetectedValues = false,
            },
        },
        LogsUniqueCount = new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountArgs
        {
            Rules = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountRuleArgs
                {
                    Condition = new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountRuleConditionArgs
                    {
                        MaxUniqueCount = "string",
                        TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindowArgs
                        {
                            LogsUniqueValueTimeWindowSpecificValue = "string",
                        },
                    },
                },
            },
            UniqueCountKeypath = "string",
            LogsFilter = new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountLogsFilterArgs
            {
                SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterArgs
                {
                    LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersArgs
                    {
                        ApplicationNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                        Severities = new[]
                        {
                            "string",
                        },
                        SubsystemNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                    },
                    LuceneQuery = "string",
                },
            },
            MaxUniqueCountPerGroupByKey = "string",
            NotificationPayloadFilters = new[]
            {
                "string",
            },
        },
        LogsRatioThreshold = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdArgs
        {
            ConditionType = "string",
            Denominator = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorArgs
            {
                SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs
                {
                    LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersArgs
                    {
                        ApplicationNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                        Severities = new[]
                        {
                            "string",
                        },
                        SubsystemNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                    },
                    LuceneQuery = "string",
                },
            },
            GroupByFor = "string",
            Numerator = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorArgs
            {
                SimpleFilter = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs
                {
                    LabelFilters = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersArgs
                    {
                        ApplicationNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                        Severities = new[]
                        {
                            "string",
                        },
                        SubsystemNames = new[]
                        {
                            new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemNameArgs
                            {
                                Operation = "string",
                                Value = "string",
                            },
                        },
                    },
                    LuceneQuery = "string",
                },
            },
            Rules = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleArgs
                {
                    Condition = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs
                    {
                        Threshold = 0,
                        TimeWindow = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs
                        {
                            LogsRatioTimeWindowSpecificValue = "string",
                        },
                    },
                    Override = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs
                    {
                        Priority = "string",
                    },
                },
            },
            DenominatorAlias = "string",
            EvaluationDelayMs = 0,
            IgnoreInfinity = false,
            NotificationPayloadFilters = new[]
            {
                "string",
            },
            NumeratorAlias = "string",
            UndetectedValuesManagement = new Ibm.Inputs.LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagementArgs
            {
                AutoRetireTimeframe = "string",
                TriggerUndetectedValues = false,
            },
        },
        MetricThreshold = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdArgs
        {
            ConditionType = "string",
            MetricFilter = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdMetricFilterArgs
            {
                Promql = "string",
            },
            MissingValues = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdMissingValuesArgs
            {
                MinNonNullValuesPct = 0,
                ReplaceWithZero = false,
            },
            Rules = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleArgs
                {
                    Condition = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleConditionArgs
                    {
                        ForOverPct = 0,
                        OfTheLast = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs
                        {
                            MetricTimeWindowDynamicDuration = "string",
                            MetricTimeWindowSpecificValue = "string",
                        },
                        Threshold = 0,
                    },
                    Override = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdRuleOverrideArgs
                    {
                        Priority = "string",
                    },
                },
            },
            EvaluationDelayMs = 0,
            UndetectedValuesManagement = new Ibm.Inputs.LogsAlertDefinitionMetricThresholdUndetectedValuesManagementArgs
            {
                AutoRetireTimeframe = "string",
                TriggerUndetectedValues = false,
            },
        },
        Name = "string",
        NotificationGroup = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupArgs
        {
            GroupByKeys = new[]
            {
                "string",
            },
            Webhooks = new[]
            {
                new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookArgs
                {
                    Integration = new Ibm.Inputs.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs
                    {
                        IntegrationId = 0,
                    },
                    Minutes = 0,
                    NotifyOn = "string",
                },
            },
        },
        PhantomMode = false,
        Priority = "string",
        Region = "string",
        Deleted = false,
    });
    
    example, err := ibm.NewLogsAlertDefinition(ctx, "logsAlertDefinitionResource", &ibm.LogsAlertDefinitionArgs{
    	InstanceId: pulumi.String("string"),
    	Type:       pulumi.String("string"),
    	LogsImmediate: &ibm.LogsAlertDefinitionLogsImmediateArgs{
    		LogsFilter: &ibm.LogsAlertDefinitionLogsImmediateLogsFilterArgs{
    			SimpleFilter: &ibm.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterArgs{
    				LabelFilters: &ibm.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersArgs{
    					ApplicationNames: ibm.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    						&ibm.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    					Severities: pulumi.StringArray{
    						pulumi.String("string"),
    					},
    					SubsystemNames: ibm.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    						&ibm.LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    				},
    				LuceneQuery: pulumi.String("string"),
    			},
    		},
    		NotificationPayloadFilters: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    	},
    	IncidentsSettings: &ibm.LogsAlertDefinitionIncidentsSettingsArgs{
    		Minutes:  pulumi.Float64(0),
    		NotifyOn: pulumi.String("string"),
    	},
    	EndpointType: pulumi.String("string"),
    	EntityLabels: pulumi.StringMap{
    		"string": pulumi.String("string"),
    	},
    	Flow: &ibm.LogsAlertDefinitionFlowArgs{
    		Stages: ibm.LogsAlertDefinitionFlowStageArray{
    			&ibm.LogsAlertDefinitionFlowStageArgs{
    				FlowStagesGroups: &ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsArgs{
    					Groups: ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArray{
    						&ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs{
    							AlertDefs: ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArray{
    								&ibm.LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs{
    									Id:  pulumi.String("string"),
    									Not: pulumi.Bool(false),
    								},
    							},
    							AlertsOp: pulumi.String("string"),
    							NextOp:   pulumi.String("string"),
    						},
    					},
    				},
    				TimeframeMs:   pulumi.String("string"),
    				TimeframeType: pulumi.String("string"),
    			},
    		},
    		EnforceSuppression: pulumi.Bool(false),
    	},
    	GroupByKeys: pulumi.StringArray{
    		pulumi.String("string"),
    	},
    	LogsNewValue: &ibm.LogsAlertDefinitionLogsNewValueArgs{
    		Rules: ibm.LogsAlertDefinitionLogsNewValueRuleArray{
    			&ibm.LogsAlertDefinitionLogsNewValueRuleArgs{
    				Condition: &ibm.LogsAlertDefinitionLogsNewValueRuleConditionArgs{
    					KeypathToTrack: pulumi.String("string"),
    					TimeWindow: &ibm.LogsAlertDefinitionLogsNewValueRuleConditionTimeWindowArgs{
    						LogsNewValueTimeWindowSpecificValue: pulumi.String("string"),
    					},
    				},
    			},
    		},
    		LogsFilter: &ibm.LogsAlertDefinitionLogsNewValueLogsFilterArgs{
    			SimpleFilter: &ibm.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterArgs{
    				LabelFilters: &ibm.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersArgs{
    					ApplicationNames: ibm.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    						&ibm.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    					Severities: pulumi.StringArray{
    						pulumi.String("string"),
    					},
    					SubsystemNames: ibm.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    						&ibm.LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    				},
    				LuceneQuery: pulumi.String("string"),
    			},
    		},
    		NotificationPayloadFilters: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    	},
    	Description:           pulumi.String("string"),
    	LogsAlertDefinitionId: pulumi.String("string"),
    	LogsAnomaly: &ibm.LogsAlertDefinitionLogsAnomalyArgs{
    		ConditionType: pulumi.String("string"),
    		Rules: ibm.LogsAlertDefinitionLogsAnomalyRuleArray{
    			&ibm.LogsAlertDefinitionLogsAnomalyRuleArgs{
    				Condition: &ibm.LogsAlertDefinitionLogsAnomalyRuleConditionArgs{
    					MinimumThreshold: pulumi.Float64(0),
    					TimeWindow: &ibm.LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindowArgs{
    						LogsTimeWindowSpecificValue: pulumi.String("string"),
    					},
    				},
    			},
    		},
    		AnomalyAlertSettings: &ibm.LogsAlertDefinitionLogsAnomalyAnomalyAlertSettingsArgs{
    			PercentageOfDeviation: pulumi.Float64(0),
    		},
    		EvaluationDelayMs: pulumi.Float64(0),
    		LogsFilter: &ibm.LogsAlertDefinitionLogsAnomalyLogsFilterArgs{
    			SimpleFilter: &ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterArgs{
    				LabelFilters: &ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersArgs{
    					ApplicationNames: ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    						&ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    					Severities: pulumi.StringArray{
    						pulumi.String("string"),
    					},
    					SubsystemNames: ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    						&ibm.LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    				},
    				LuceneQuery: pulumi.String("string"),
    			},
    		},
    		NotificationPayloadFilters: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    	},
    	Enabled: pulumi.Bool(false),
    	ActiveOn: &ibm.LogsAlertDefinitionActiveOnArgs{
    		DayOfWeeks: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    		EndTime: &ibm.LogsAlertDefinitionActiveOnEndTimeArgs{
    			Hours:   pulumi.Float64(0),
    			Minutes: pulumi.Float64(0),
    		},
    		StartTime: &ibm.LogsAlertDefinitionActiveOnStartTimeArgs{
    			Hours:   pulumi.Float64(0),
    			Minutes: pulumi.Float64(0),
    		},
    	},
    	MetricAnomaly: &ibm.LogsAlertDefinitionMetricAnomalyArgs{
    		ConditionType: pulumi.String("string"),
    		MetricFilter: &ibm.LogsAlertDefinitionMetricAnomalyMetricFilterArgs{
    			Promql: pulumi.String("string"),
    		},
    		Rules: ibm.LogsAlertDefinitionMetricAnomalyRuleArray{
    			&ibm.LogsAlertDefinitionMetricAnomalyRuleArgs{
    				Condition: &ibm.LogsAlertDefinitionMetricAnomalyRuleConditionArgs{
    					MinNonNullValuesPct: pulumi.Float64(0),
    					OfTheLast: &ibm.LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLastArgs{
    						MetricTimeWindowDynamicDuration: pulumi.String("string"),
    						MetricTimeWindowSpecificValue:   pulumi.String("string"),
    					},
    					Threshold:  pulumi.Float64(0),
    					ForOverPct: pulumi.Float64(0),
    				},
    			},
    		},
    		AnomalyAlertSettings: &ibm.LogsAlertDefinitionMetricAnomalyAnomalyAlertSettingsArgs{
    			PercentageOfDeviation: pulumi.Float64(0),
    		},
    		EvaluationDelayMs: pulumi.Float64(0),
    	},
    	LogsThreshold: &ibm.LogsAlertDefinitionLogsThresholdArgs{
    		ConditionType: pulumi.String("string"),
    		Rules: ibm.LogsAlertDefinitionLogsThresholdRuleArray{
    			&ibm.LogsAlertDefinitionLogsThresholdRuleArgs{
    				Condition: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionArgs{
    					Threshold: pulumi.Float64(0),
    					TimeWindow: &ibm.LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs{
    						LogsTimeWindowSpecificValue: pulumi.String("string"),
    					},
    				},
    				Override: &ibm.LogsAlertDefinitionLogsThresholdRuleOverrideArgs{
    					Priority: pulumi.String("string"),
    				},
    			},
    		},
    		EvaluationDelayMs: pulumi.Float64(0),
    		LogsFilter: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterArgs{
    			SimpleFilter: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs{
    				LabelFilters: &ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs{
    					ApplicationNames: ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    						&ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    					Severities: pulumi.StringArray{
    						pulumi.String("string"),
    					},
    					SubsystemNames: ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    						&ibm.LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    				},
    				LuceneQuery: pulumi.String("string"),
    			},
    		},
    		NotificationPayloadFilters: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    		UndetectedValuesManagement: &ibm.LogsAlertDefinitionLogsThresholdUndetectedValuesManagementArgs{
    			AutoRetireTimeframe:     pulumi.String("string"),
    			TriggerUndetectedValues: pulumi.Bool(false),
    		},
    	},
    	LogsTimeRelativeThreshold: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdArgs{
    		ConditionType: pulumi.String("string"),
    		Rules: ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArray{
    			&ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs{
    				Condition: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs{
    					ComparedTo: pulumi.String("string"),
    					Threshold:  pulumi.Float64(0),
    				},
    				Override: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs{
    					Priority: pulumi.String("string"),
    				},
    			},
    		},
    		EvaluationDelayMs: pulumi.Float64(0),
    		IgnoreInfinity:    pulumi.Bool(false),
    		LogsFilter: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs{
    			SimpleFilter: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs{
    				LabelFilters: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersArgs{
    					ApplicationNames: ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    						&ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    					Severities: pulumi.StringArray{
    						pulumi.String("string"),
    					},
    					SubsystemNames: ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    						&ibm.LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    				},
    				LuceneQuery: pulumi.String("string"),
    			},
    		},
    		NotificationPayloadFilters: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    		UndetectedValuesManagement: &ibm.LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagementArgs{
    			AutoRetireTimeframe:     pulumi.String("string"),
    			TriggerUndetectedValues: pulumi.Bool(false),
    		},
    	},
    	LogsUniqueCount: &ibm.LogsAlertDefinitionLogsUniqueCountArgs{
    		Rules: ibm.LogsAlertDefinitionLogsUniqueCountRuleArray{
    			&ibm.LogsAlertDefinitionLogsUniqueCountRuleArgs{
    				Condition: &ibm.LogsAlertDefinitionLogsUniqueCountRuleConditionArgs{
    					MaxUniqueCount: pulumi.String("string"),
    					TimeWindow: &ibm.LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindowArgs{
    						LogsUniqueValueTimeWindowSpecificValue: pulumi.String("string"),
    					},
    				},
    			},
    		},
    		UniqueCountKeypath: pulumi.String("string"),
    		LogsFilter: &ibm.LogsAlertDefinitionLogsUniqueCountLogsFilterArgs{
    			SimpleFilter: &ibm.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterArgs{
    				LabelFilters: &ibm.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersArgs{
    					ApplicationNames: ibm.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationNameArray{
    						&ibm.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    					Severities: pulumi.StringArray{
    						pulumi.String("string"),
    					},
    					SubsystemNames: ibm.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemNameArray{
    						&ibm.LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    				},
    				LuceneQuery: pulumi.String("string"),
    			},
    		},
    		MaxUniqueCountPerGroupByKey: pulumi.String("string"),
    		NotificationPayloadFilters: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    	},
    	LogsRatioThreshold: &ibm.LogsAlertDefinitionLogsRatioThresholdArgs{
    		ConditionType: pulumi.String("string"),
    		Denominator: &ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorArgs{
    			SimpleFilter: &ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs{
    				LabelFilters: &ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersArgs{
    					ApplicationNames: ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationNameArray{
    						&ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    					Severities: pulumi.StringArray{
    						pulumi.String("string"),
    					},
    					SubsystemNames: ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemNameArray{
    						&ibm.LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    				},
    				LuceneQuery: pulumi.String("string"),
    			},
    		},
    		GroupByFor: pulumi.String("string"),
    		Numerator: &ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorArgs{
    			SimpleFilter: &ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs{
    				LabelFilters: &ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersArgs{
    					ApplicationNames: ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationNameArray{
    						&ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    					Severities: pulumi.StringArray{
    						pulumi.String("string"),
    					},
    					SubsystemNames: ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemNameArray{
    						&ibm.LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemNameArgs{
    							Operation: pulumi.String("string"),
    							Value:     pulumi.String("string"),
    						},
    					},
    				},
    				LuceneQuery: pulumi.String("string"),
    			},
    		},
    		Rules: ibm.LogsAlertDefinitionLogsRatioThresholdRuleArray{
    			&ibm.LogsAlertDefinitionLogsRatioThresholdRuleArgs{
    				Condition: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs{
    					Threshold: pulumi.Float64(0),
    					TimeWindow: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs{
    						LogsRatioTimeWindowSpecificValue: pulumi.String("string"),
    					},
    				},
    				Override: &ibm.LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs{
    					Priority: pulumi.String("string"),
    				},
    			},
    		},
    		DenominatorAlias:  pulumi.String("string"),
    		EvaluationDelayMs: pulumi.Float64(0),
    		IgnoreInfinity:    pulumi.Bool(false),
    		NotificationPayloadFilters: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    		NumeratorAlias: pulumi.String("string"),
    		UndetectedValuesManagement: &ibm.LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagementArgs{
    			AutoRetireTimeframe:     pulumi.String("string"),
    			TriggerUndetectedValues: pulumi.Bool(false),
    		},
    	},
    	MetricThreshold: &ibm.LogsAlertDefinitionMetricThresholdArgs{
    		ConditionType: pulumi.String("string"),
    		MetricFilter: &ibm.LogsAlertDefinitionMetricThresholdMetricFilterArgs{
    			Promql: pulumi.String("string"),
    		},
    		MissingValues: &ibm.LogsAlertDefinitionMetricThresholdMissingValuesArgs{
    			MinNonNullValuesPct: pulumi.Float64(0),
    			ReplaceWithZero:     pulumi.Bool(false),
    		},
    		Rules: ibm.LogsAlertDefinitionMetricThresholdRuleArray{
    			&ibm.LogsAlertDefinitionMetricThresholdRuleArgs{
    				Condition: &ibm.LogsAlertDefinitionMetricThresholdRuleConditionArgs{
    					ForOverPct: pulumi.Float64(0),
    					OfTheLast: &ibm.LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs{
    						MetricTimeWindowDynamicDuration: pulumi.String("string"),
    						MetricTimeWindowSpecificValue:   pulumi.String("string"),
    					},
    					Threshold: pulumi.Float64(0),
    				},
    				Override: &ibm.LogsAlertDefinitionMetricThresholdRuleOverrideArgs{
    					Priority: pulumi.String("string"),
    				},
    			},
    		},
    		EvaluationDelayMs: pulumi.Float64(0),
    		UndetectedValuesManagement: &ibm.LogsAlertDefinitionMetricThresholdUndetectedValuesManagementArgs{
    			AutoRetireTimeframe:     pulumi.String("string"),
    			TriggerUndetectedValues: pulumi.Bool(false),
    		},
    	},
    	Name: pulumi.String("string"),
    	NotificationGroup: &ibm.LogsAlertDefinitionNotificationGroupArgs{
    		GroupByKeys: pulumi.StringArray{
    			pulumi.String("string"),
    		},
    		Webhooks: ibm.LogsAlertDefinitionNotificationGroupWebhookArray{
    			&ibm.LogsAlertDefinitionNotificationGroupWebhookArgs{
    				Integration: &ibm.LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs{
    					IntegrationId: pulumi.Float64(0),
    				},
    				Minutes:  pulumi.Float64(0),
    				NotifyOn: pulumi.String("string"),
    			},
    		},
    	},
    	PhantomMode: pulumi.Bool(false),
    	Priority:    pulumi.String("string"),
    	Region:      pulumi.String("string"),
    	Deleted:     pulumi.Bool(false),
    })
    
    var logsAlertDefinitionResource = new LogsAlertDefinition("logsAlertDefinitionResource", LogsAlertDefinitionArgs.builder()
        .instanceId("string")
        .type("string")
        .logsImmediate(LogsAlertDefinitionLogsImmediateArgs.builder()
            .logsFilter(LogsAlertDefinitionLogsImmediateLogsFilterArgs.builder()
                .simpleFilter(LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterArgs.builder()
                    .labelFilters(LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersArgs.builder()
                        .applicationNames(LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .severities("string")
                        .subsystemNames(LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .build())
                    .luceneQuery("string")
                    .build())
                .build())
            .notificationPayloadFilters("string")
            .build())
        .incidentsSettings(LogsAlertDefinitionIncidentsSettingsArgs.builder()
            .minutes(0.0)
            .notifyOn("string")
            .build())
        .endpointType("string")
        .entityLabels(Map.of("string", "string"))
        .flow(LogsAlertDefinitionFlowArgs.builder()
            .stages(LogsAlertDefinitionFlowStageArgs.builder()
                .flowStagesGroups(LogsAlertDefinitionFlowStageFlowStagesGroupsArgs.builder()
                    .groups(LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs.builder()
                        .alertDefs(LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs.builder()
                            .id("string")
                            .not(false)
                            .build())
                        .alertsOp("string")
                        .nextOp("string")
                        .build())
                    .build())
                .timeframeMs("string")
                .timeframeType("string")
                .build())
            .enforceSuppression(false)
            .build())
        .groupByKeys("string")
        .logsNewValue(LogsAlertDefinitionLogsNewValueArgs.builder()
            .rules(LogsAlertDefinitionLogsNewValueRuleArgs.builder()
                .condition(LogsAlertDefinitionLogsNewValueRuleConditionArgs.builder()
                    .keypathToTrack("string")
                    .timeWindow(LogsAlertDefinitionLogsNewValueRuleConditionTimeWindowArgs.builder()
                        .logsNewValueTimeWindowSpecificValue("string")
                        .build())
                    .build())
                .build())
            .logsFilter(LogsAlertDefinitionLogsNewValueLogsFilterArgs.builder()
                .simpleFilter(LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterArgs.builder()
                    .labelFilters(LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersArgs.builder()
                        .applicationNames(LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .severities("string")
                        .subsystemNames(LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .build())
                    .luceneQuery("string")
                    .build())
                .build())
            .notificationPayloadFilters("string")
            .build())
        .description("string")
        .logsAlertDefinitionId("string")
        .logsAnomaly(LogsAlertDefinitionLogsAnomalyArgs.builder()
            .conditionType("string")
            .rules(LogsAlertDefinitionLogsAnomalyRuleArgs.builder()
                .condition(LogsAlertDefinitionLogsAnomalyRuleConditionArgs.builder()
                    .minimumThreshold(0.0)
                    .timeWindow(LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindowArgs.builder()
                        .logsTimeWindowSpecificValue("string")
                        .build())
                    .build())
                .build())
            .anomalyAlertSettings(LogsAlertDefinitionLogsAnomalyAnomalyAlertSettingsArgs.builder()
                .percentageOfDeviation(0.0)
                .build())
            .evaluationDelayMs(0.0)
            .logsFilter(LogsAlertDefinitionLogsAnomalyLogsFilterArgs.builder()
                .simpleFilter(LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterArgs.builder()
                    .labelFilters(LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersArgs.builder()
                        .applicationNames(LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .severities("string")
                        .subsystemNames(LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .build())
                    .luceneQuery("string")
                    .build())
                .build())
            .notificationPayloadFilters("string")
            .build())
        .enabled(false)
        .activeOn(LogsAlertDefinitionActiveOnArgs.builder()
            .dayOfWeeks("string")
            .endTime(LogsAlertDefinitionActiveOnEndTimeArgs.builder()
                .hours(0.0)
                .minutes(0.0)
                .build())
            .startTime(LogsAlertDefinitionActiveOnStartTimeArgs.builder()
                .hours(0.0)
                .minutes(0.0)
                .build())
            .build())
        .metricAnomaly(LogsAlertDefinitionMetricAnomalyArgs.builder()
            .conditionType("string")
            .metricFilter(LogsAlertDefinitionMetricAnomalyMetricFilterArgs.builder()
                .promql("string")
                .build())
            .rules(LogsAlertDefinitionMetricAnomalyRuleArgs.builder()
                .condition(LogsAlertDefinitionMetricAnomalyRuleConditionArgs.builder()
                    .minNonNullValuesPct(0.0)
                    .ofTheLast(LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLastArgs.builder()
                        .metricTimeWindowDynamicDuration("string")
                        .metricTimeWindowSpecificValue("string")
                        .build())
                    .threshold(0.0)
                    .forOverPct(0.0)
                    .build())
                .build())
            .anomalyAlertSettings(LogsAlertDefinitionMetricAnomalyAnomalyAlertSettingsArgs.builder()
                .percentageOfDeviation(0.0)
                .build())
            .evaluationDelayMs(0.0)
            .build())
        .logsThreshold(LogsAlertDefinitionLogsThresholdArgs.builder()
            .conditionType("string")
            .rules(LogsAlertDefinitionLogsThresholdRuleArgs.builder()
                .condition(LogsAlertDefinitionLogsThresholdRuleConditionArgs.builder()
                    .threshold(0.0)
                    .timeWindow(LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs.builder()
                        .logsTimeWindowSpecificValue("string")
                        .build())
                    .build())
                .override(LogsAlertDefinitionLogsThresholdRuleOverrideArgs.builder()
                    .priority("string")
                    .build())
                .build())
            .evaluationDelayMs(0.0)
            .logsFilter(LogsAlertDefinitionLogsThresholdLogsFilterArgs.builder()
                .simpleFilter(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs.builder()
                    .labelFilters(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs.builder()
                        .applicationNames(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .severities("string")
                        .subsystemNames(LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .build())
                    .luceneQuery("string")
                    .build())
                .build())
            .notificationPayloadFilters("string")
            .undetectedValuesManagement(LogsAlertDefinitionLogsThresholdUndetectedValuesManagementArgs.builder()
                .autoRetireTimeframe("string")
                .triggerUndetectedValues(false)
                .build())
            .build())
        .logsTimeRelativeThreshold(LogsAlertDefinitionLogsTimeRelativeThresholdArgs.builder()
            .conditionType("string")
            .rules(LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs.builder()
                .condition(LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs.builder()
                    .comparedTo("string")
                    .threshold(0.0)
                    .build())
                .override(LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs.builder()
                    .priority("string")
                    .build())
                .build())
            .evaluationDelayMs(0.0)
            .ignoreInfinity(false)
            .logsFilter(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs.builder()
                .simpleFilter(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs.builder()
                    .labelFilters(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersArgs.builder()
                        .applicationNames(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .severities("string")
                        .subsystemNames(LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .build())
                    .luceneQuery("string")
                    .build())
                .build())
            .notificationPayloadFilters("string")
            .undetectedValuesManagement(LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagementArgs.builder()
                .autoRetireTimeframe("string")
                .triggerUndetectedValues(false)
                .build())
            .build())
        .logsUniqueCount(LogsAlertDefinitionLogsUniqueCountArgs.builder()
            .rules(LogsAlertDefinitionLogsUniqueCountRuleArgs.builder()
                .condition(LogsAlertDefinitionLogsUniqueCountRuleConditionArgs.builder()
                    .maxUniqueCount("string")
                    .timeWindow(LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindowArgs.builder()
                        .logsUniqueValueTimeWindowSpecificValue("string")
                        .build())
                    .build())
                .build())
            .uniqueCountKeypath("string")
            .logsFilter(LogsAlertDefinitionLogsUniqueCountLogsFilterArgs.builder()
                .simpleFilter(LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterArgs.builder()
                    .labelFilters(LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersArgs.builder()
                        .applicationNames(LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .severities("string")
                        .subsystemNames(LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .build())
                    .luceneQuery("string")
                    .build())
                .build())
            .maxUniqueCountPerGroupByKey("string")
            .notificationPayloadFilters("string")
            .build())
        .logsRatioThreshold(LogsAlertDefinitionLogsRatioThresholdArgs.builder()
            .conditionType("string")
            .denominator(LogsAlertDefinitionLogsRatioThresholdDenominatorArgs.builder()
                .simpleFilter(LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs.builder()
                    .labelFilters(LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersArgs.builder()
                        .applicationNames(LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .severities("string")
                        .subsystemNames(LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .build())
                    .luceneQuery("string")
                    .build())
                .build())
            .groupByFor("string")
            .numerator(LogsAlertDefinitionLogsRatioThresholdNumeratorArgs.builder()
                .simpleFilter(LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs.builder()
                    .labelFilters(LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersArgs.builder()
                        .applicationNames(LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .severities("string")
                        .subsystemNames(LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemNameArgs.builder()
                            .operation("string")
                            .value("string")
                            .build())
                        .build())
                    .luceneQuery("string")
                    .build())
                .build())
            .rules(LogsAlertDefinitionLogsRatioThresholdRuleArgs.builder()
                .condition(LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs.builder()
                    .threshold(0.0)
                    .timeWindow(LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs.builder()
                        .logsRatioTimeWindowSpecificValue("string")
                        .build())
                    .build())
                .override(LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs.builder()
                    .priority("string")
                    .build())
                .build())
            .denominatorAlias("string")
            .evaluationDelayMs(0.0)
            .ignoreInfinity(false)
            .notificationPayloadFilters("string")
            .numeratorAlias("string")
            .undetectedValuesManagement(LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagementArgs.builder()
                .autoRetireTimeframe("string")
                .triggerUndetectedValues(false)
                .build())
            .build())
        .metricThreshold(LogsAlertDefinitionMetricThresholdArgs.builder()
            .conditionType("string")
            .metricFilter(LogsAlertDefinitionMetricThresholdMetricFilterArgs.builder()
                .promql("string")
                .build())
            .missingValues(LogsAlertDefinitionMetricThresholdMissingValuesArgs.builder()
                .minNonNullValuesPct(0.0)
                .replaceWithZero(false)
                .build())
            .rules(LogsAlertDefinitionMetricThresholdRuleArgs.builder()
                .condition(LogsAlertDefinitionMetricThresholdRuleConditionArgs.builder()
                    .forOverPct(0.0)
                    .ofTheLast(LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs.builder()
                        .metricTimeWindowDynamicDuration("string")
                        .metricTimeWindowSpecificValue("string")
                        .build())
                    .threshold(0.0)
                    .build())
                .override(LogsAlertDefinitionMetricThresholdRuleOverrideArgs.builder()
                    .priority("string")
                    .build())
                .build())
            .evaluationDelayMs(0.0)
            .undetectedValuesManagement(LogsAlertDefinitionMetricThresholdUndetectedValuesManagementArgs.builder()
                .autoRetireTimeframe("string")
                .triggerUndetectedValues(false)
                .build())
            .build())
        .name("string")
        .notificationGroup(LogsAlertDefinitionNotificationGroupArgs.builder()
            .groupByKeys("string")
            .webhooks(LogsAlertDefinitionNotificationGroupWebhookArgs.builder()
                .integration(LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs.builder()
                    .integrationId(0.0)
                    .build())
                .minutes(0.0)
                .notifyOn("string")
                .build())
            .build())
        .phantomMode(false)
        .priority("string")
        .region("string")
        .deleted(false)
        .build());
    
    logs_alert_definition_resource = ibm.LogsAlertDefinition("logsAlertDefinitionResource",
        instance_id="string",
        type="string",
        logs_immediate={
            "logs_filter": {
                "simple_filter": {
                    "label_filters": {
                        "application_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                        "severities": ["string"],
                        "subsystem_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                    },
                    "lucene_query": "string",
                },
            },
            "notification_payload_filters": ["string"],
        },
        incidents_settings={
            "minutes": 0,
            "notify_on": "string",
        },
        endpoint_type="string",
        entity_labels={
            "string": "string",
        },
        flow={
            "stages": [{
                "flow_stages_groups": {
                    "groups": [{
                        "alert_defs": [{
                            "id": "string",
                            "not_": False,
                        }],
                        "alerts_op": "string",
                        "next_op": "string",
                    }],
                },
                "timeframe_ms": "string",
                "timeframe_type": "string",
            }],
            "enforce_suppression": False,
        },
        group_by_keys=["string"],
        logs_new_value={
            "rules": [{
                "condition": {
                    "keypath_to_track": "string",
                    "time_window": {
                        "logs_new_value_time_window_specific_value": "string",
                    },
                },
            }],
            "logs_filter": {
                "simple_filter": {
                    "label_filters": {
                        "application_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                        "severities": ["string"],
                        "subsystem_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                    },
                    "lucene_query": "string",
                },
            },
            "notification_payload_filters": ["string"],
        },
        description="string",
        logs_alert_definition_id="string",
        logs_anomaly={
            "condition_type": "string",
            "rules": [{
                "condition": {
                    "minimum_threshold": 0,
                    "time_window": {
                        "logs_time_window_specific_value": "string",
                    },
                },
            }],
            "anomaly_alert_settings": {
                "percentage_of_deviation": 0,
            },
            "evaluation_delay_ms": 0,
            "logs_filter": {
                "simple_filter": {
                    "label_filters": {
                        "application_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                        "severities": ["string"],
                        "subsystem_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                    },
                    "lucene_query": "string",
                },
            },
            "notification_payload_filters": ["string"],
        },
        enabled=False,
        active_on={
            "day_of_weeks": ["string"],
            "end_time": {
                "hours": 0,
                "minutes": 0,
            },
            "start_time": {
                "hours": 0,
                "minutes": 0,
            },
        },
        metric_anomaly={
            "condition_type": "string",
            "metric_filter": {
                "promql": "string",
            },
            "rules": [{
                "condition": {
                    "min_non_null_values_pct": 0,
                    "of_the_last": {
                        "metric_time_window_dynamic_duration": "string",
                        "metric_time_window_specific_value": "string",
                    },
                    "threshold": 0,
                    "for_over_pct": 0,
                },
            }],
            "anomaly_alert_settings": {
                "percentage_of_deviation": 0,
            },
            "evaluation_delay_ms": 0,
        },
        logs_threshold={
            "condition_type": "string",
            "rules": [{
                "condition": {
                    "threshold": 0,
                    "time_window": {
                        "logs_time_window_specific_value": "string",
                    },
                },
                "override": {
                    "priority": "string",
                },
            }],
            "evaluation_delay_ms": 0,
            "logs_filter": {
                "simple_filter": {
                    "label_filters": {
                        "application_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                        "severities": ["string"],
                        "subsystem_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                    },
                    "lucene_query": "string",
                },
            },
            "notification_payload_filters": ["string"],
            "undetected_values_management": {
                "auto_retire_timeframe": "string",
                "trigger_undetected_values": False,
            },
        },
        logs_time_relative_threshold={
            "condition_type": "string",
            "rules": [{
                "condition": {
                    "compared_to": "string",
                    "threshold": 0,
                },
                "override": {
                    "priority": "string",
                },
            }],
            "evaluation_delay_ms": 0,
            "ignore_infinity": False,
            "logs_filter": {
                "simple_filter": {
                    "label_filters": {
                        "application_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                        "severities": ["string"],
                        "subsystem_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                    },
                    "lucene_query": "string",
                },
            },
            "notification_payload_filters": ["string"],
            "undetected_values_management": {
                "auto_retire_timeframe": "string",
                "trigger_undetected_values": False,
            },
        },
        logs_unique_count={
            "rules": [{
                "condition": {
                    "max_unique_count": "string",
                    "time_window": {
                        "logs_unique_value_time_window_specific_value": "string",
                    },
                },
            }],
            "unique_count_keypath": "string",
            "logs_filter": {
                "simple_filter": {
                    "label_filters": {
                        "application_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                        "severities": ["string"],
                        "subsystem_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                    },
                    "lucene_query": "string",
                },
            },
            "max_unique_count_per_group_by_key": "string",
            "notification_payload_filters": ["string"],
        },
        logs_ratio_threshold={
            "condition_type": "string",
            "denominator": {
                "simple_filter": {
                    "label_filters": {
                        "application_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                        "severities": ["string"],
                        "subsystem_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                    },
                    "lucene_query": "string",
                },
            },
            "group_by_for": "string",
            "numerator": {
                "simple_filter": {
                    "label_filters": {
                        "application_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                        "severities": ["string"],
                        "subsystem_names": [{
                            "operation": "string",
                            "value": "string",
                        }],
                    },
                    "lucene_query": "string",
                },
            },
            "rules": [{
                "condition": {
                    "threshold": 0,
                    "time_window": {
                        "logs_ratio_time_window_specific_value": "string",
                    },
                },
                "override": {
                    "priority": "string",
                },
            }],
            "denominator_alias": "string",
            "evaluation_delay_ms": 0,
            "ignore_infinity": False,
            "notification_payload_filters": ["string"],
            "numerator_alias": "string",
            "undetected_values_management": {
                "auto_retire_timeframe": "string",
                "trigger_undetected_values": False,
            },
        },
        metric_threshold={
            "condition_type": "string",
            "metric_filter": {
                "promql": "string",
            },
            "missing_values": {
                "min_non_null_values_pct": 0,
                "replace_with_zero": False,
            },
            "rules": [{
                "condition": {
                    "for_over_pct": 0,
                    "of_the_last": {
                        "metric_time_window_dynamic_duration": "string",
                        "metric_time_window_specific_value": "string",
                    },
                    "threshold": 0,
                },
                "override": {
                    "priority": "string",
                },
            }],
            "evaluation_delay_ms": 0,
            "undetected_values_management": {
                "auto_retire_timeframe": "string",
                "trigger_undetected_values": False,
            },
        },
        name="string",
        notification_group={
            "group_by_keys": ["string"],
            "webhooks": [{
                "integration": {
                    "integration_id": 0,
                },
                "minutes": 0,
                "notify_on": "string",
            }],
        },
        phantom_mode=False,
        priority="string",
        region="string",
        deleted=False)
    
    const logsAlertDefinitionResource = new ibm.LogsAlertDefinition("logsAlertDefinitionResource", {
        instanceId: "string",
        type: "string",
        logsImmediate: {
            logsFilter: {
                simpleFilter: {
                    labelFilters: {
                        applicationNames: [{
                            operation: "string",
                            value: "string",
                        }],
                        severities: ["string"],
                        subsystemNames: [{
                            operation: "string",
                            value: "string",
                        }],
                    },
                    luceneQuery: "string",
                },
            },
            notificationPayloadFilters: ["string"],
        },
        incidentsSettings: {
            minutes: 0,
            notifyOn: "string",
        },
        endpointType: "string",
        entityLabels: {
            string: "string",
        },
        flow: {
            stages: [{
                flowStagesGroups: {
                    groups: [{
                        alertDefs: [{
                            id: "string",
                            not: false,
                        }],
                        alertsOp: "string",
                        nextOp: "string",
                    }],
                },
                timeframeMs: "string",
                timeframeType: "string",
            }],
            enforceSuppression: false,
        },
        groupByKeys: ["string"],
        logsNewValue: {
            rules: [{
                condition: {
                    keypathToTrack: "string",
                    timeWindow: {
                        logsNewValueTimeWindowSpecificValue: "string",
                    },
                },
            }],
            logsFilter: {
                simpleFilter: {
                    labelFilters: {
                        applicationNames: [{
                            operation: "string",
                            value: "string",
                        }],
                        severities: ["string"],
                        subsystemNames: [{
                            operation: "string",
                            value: "string",
                        }],
                    },
                    luceneQuery: "string",
                },
            },
            notificationPayloadFilters: ["string"],
        },
        description: "string",
        logsAlertDefinitionId: "string",
        logsAnomaly: {
            conditionType: "string",
            rules: [{
                condition: {
                    minimumThreshold: 0,
                    timeWindow: {
                        logsTimeWindowSpecificValue: "string",
                    },
                },
            }],
            anomalyAlertSettings: {
                percentageOfDeviation: 0,
            },
            evaluationDelayMs: 0,
            logsFilter: {
                simpleFilter: {
                    labelFilters: {
                        applicationNames: [{
                            operation: "string",
                            value: "string",
                        }],
                        severities: ["string"],
                        subsystemNames: [{
                            operation: "string",
                            value: "string",
                        }],
                    },
                    luceneQuery: "string",
                },
            },
            notificationPayloadFilters: ["string"],
        },
        enabled: false,
        activeOn: {
            dayOfWeeks: ["string"],
            endTime: {
                hours: 0,
                minutes: 0,
            },
            startTime: {
                hours: 0,
                minutes: 0,
            },
        },
        metricAnomaly: {
            conditionType: "string",
            metricFilter: {
                promql: "string",
            },
            rules: [{
                condition: {
                    minNonNullValuesPct: 0,
                    ofTheLast: {
                        metricTimeWindowDynamicDuration: "string",
                        metricTimeWindowSpecificValue: "string",
                    },
                    threshold: 0,
                    forOverPct: 0,
                },
            }],
            anomalyAlertSettings: {
                percentageOfDeviation: 0,
            },
            evaluationDelayMs: 0,
        },
        logsThreshold: {
            conditionType: "string",
            rules: [{
                condition: {
                    threshold: 0,
                    timeWindow: {
                        logsTimeWindowSpecificValue: "string",
                    },
                },
                override: {
                    priority: "string",
                },
            }],
            evaluationDelayMs: 0,
            logsFilter: {
                simpleFilter: {
                    labelFilters: {
                        applicationNames: [{
                            operation: "string",
                            value: "string",
                        }],
                        severities: ["string"],
                        subsystemNames: [{
                            operation: "string",
                            value: "string",
                        }],
                    },
                    luceneQuery: "string",
                },
            },
            notificationPayloadFilters: ["string"],
            undetectedValuesManagement: {
                autoRetireTimeframe: "string",
                triggerUndetectedValues: false,
            },
        },
        logsTimeRelativeThreshold: {
            conditionType: "string",
            rules: [{
                condition: {
                    comparedTo: "string",
                    threshold: 0,
                },
                override: {
                    priority: "string",
                },
            }],
            evaluationDelayMs: 0,
            ignoreInfinity: false,
            logsFilter: {
                simpleFilter: {
                    labelFilters: {
                        applicationNames: [{
                            operation: "string",
                            value: "string",
                        }],
                        severities: ["string"],
                        subsystemNames: [{
                            operation: "string",
                            value: "string",
                        }],
                    },
                    luceneQuery: "string",
                },
            },
            notificationPayloadFilters: ["string"],
            undetectedValuesManagement: {
                autoRetireTimeframe: "string",
                triggerUndetectedValues: false,
            },
        },
        logsUniqueCount: {
            rules: [{
                condition: {
                    maxUniqueCount: "string",
                    timeWindow: {
                        logsUniqueValueTimeWindowSpecificValue: "string",
                    },
                },
            }],
            uniqueCountKeypath: "string",
            logsFilter: {
                simpleFilter: {
                    labelFilters: {
                        applicationNames: [{
                            operation: "string",
                            value: "string",
                        }],
                        severities: ["string"],
                        subsystemNames: [{
                            operation: "string",
                            value: "string",
                        }],
                    },
                    luceneQuery: "string",
                },
            },
            maxUniqueCountPerGroupByKey: "string",
            notificationPayloadFilters: ["string"],
        },
        logsRatioThreshold: {
            conditionType: "string",
            denominator: {
                simpleFilter: {
                    labelFilters: {
                        applicationNames: [{
                            operation: "string",
                            value: "string",
                        }],
                        severities: ["string"],
                        subsystemNames: [{
                            operation: "string",
                            value: "string",
                        }],
                    },
                    luceneQuery: "string",
                },
            },
            groupByFor: "string",
            numerator: {
                simpleFilter: {
                    labelFilters: {
                        applicationNames: [{
                            operation: "string",
                            value: "string",
                        }],
                        severities: ["string"],
                        subsystemNames: [{
                            operation: "string",
                            value: "string",
                        }],
                    },
                    luceneQuery: "string",
                },
            },
            rules: [{
                condition: {
                    threshold: 0,
                    timeWindow: {
                        logsRatioTimeWindowSpecificValue: "string",
                    },
                },
                override: {
                    priority: "string",
                },
            }],
            denominatorAlias: "string",
            evaluationDelayMs: 0,
            ignoreInfinity: false,
            notificationPayloadFilters: ["string"],
            numeratorAlias: "string",
            undetectedValuesManagement: {
                autoRetireTimeframe: "string",
                triggerUndetectedValues: false,
            },
        },
        metricThreshold: {
            conditionType: "string",
            metricFilter: {
                promql: "string",
            },
            missingValues: {
                minNonNullValuesPct: 0,
                replaceWithZero: false,
            },
            rules: [{
                condition: {
                    forOverPct: 0,
                    ofTheLast: {
                        metricTimeWindowDynamicDuration: "string",
                        metricTimeWindowSpecificValue: "string",
                    },
                    threshold: 0,
                },
                override: {
                    priority: "string",
                },
            }],
            evaluationDelayMs: 0,
            undetectedValuesManagement: {
                autoRetireTimeframe: "string",
                triggerUndetectedValues: false,
            },
        },
        name: "string",
        notificationGroup: {
            groupByKeys: ["string"],
            webhooks: [{
                integration: {
                    integrationId: 0,
                },
                minutes: 0,
                notifyOn: "string",
            }],
        },
        phantomMode: false,
        priority: "string",
        region: "string",
        deleted: false,
    });
    
    type: ibm:LogsAlertDefinition
    properties:
        activeOn:
            dayOfWeeks:
                - string
            endTime:
                hours: 0
                minutes: 0
            startTime:
                hours: 0
                minutes: 0
        deleted: false
        description: string
        enabled: false
        endpointType: string
        entityLabels:
            string: string
        flow:
            enforceSuppression: false
            stages:
                - flowStagesGroups:
                    groups:
                        - alertDefs:
                            - id: string
                              not: false
                          alertsOp: string
                          nextOp: string
                  timeframeMs: string
                  timeframeType: string
        groupByKeys:
            - string
        incidentsSettings:
            minutes: 0
            notifyOn: string
        instanceId: string
        logsAlertDefinitionId: string
        logsAnomaly:
            anomalyAlertSettings:
                percentageOfDeviation: 0
            conditionType: string
            evaluationDelayMs: 0
            logsFilter:
                simpleFilter:
                    labelFilters:
                        applicationNames:
                            - operation: string
                              value: string
                        severities:
                            - string
                        subsystemNames:
                            - operation: string
                              value: string
                    luceneQuery: string
            notificationPayloadFilters:
                - string
            rules:
                - condition:
                    minimumThreshold: 0
                    timeWindow:
                        logsTimeWindowSpecificValue: string
        logsImmediate:
            logsFilter:
                simpleFilter:
                    labelFilters:
                        applicationNames:
                            - operation: string
                              value: string
                        severities:
                            - string
                        subsystemNames:
                            - operation: string
                              value: string
                    luceneQuery: string
            notificationPayloadFilters:
                - string
        logsNewValue:
            logsFilter:
                simpleFilter:
                    labelFilters:
                        applicationNames:
                            - operation: string
                              value: string
                        severities:
                            - string
                        subsystemNames:
                            - operation: string
                              value: string
                    luceneQuery: string
            notificationPayloadFilters:
                - string
            rules:
                - condition:
                    keypathToTrack: string
                    timeWindow:
                        logsNewValueTimeWindowSpecificValue: string
        logsRatioThreshold:
            conditionType: string
            denominator:
                simpleFilter:
                    labelFilters:
                        applicationNames:
                            - operation: string
                              value: string
                        severities:
                            - string
                        subsystemNames:
                            - operation: string
                              value: string
                    luceneQuery: string
            denominatorAlias: string
            evaluationDelayMs: 0
            groupByFor: string
            ignoreInfinity: false
            notificationPayloadFilters:
                - string
            numerator:
                simpleFilter:
                    labelFilters:
                        applicationNames:
                            - operation: string
                              value: string
                        severities:
                            - string
                        subsystemNames:
                            - operation: string
                              value: string
                    luceneQuery: string
            numeratorAlias: string
            rules:
                - condition:
                    threshold: 0
                    timeWindow:
                        logsRatioTimeWindowSpecificValue: string
                  override:
                    priority: string
            undetectedValuesManagement:
                autoRetireTimeframe: string
                triggerUndetectedValues: false
        logsThreshold:
            conditionType: string
            evaluationDelayMs: 0
            logsFilter:
                simpleFilter:
                    labelFilters:
                        applicationNames:
                            - operation: string
                              value: string
                        severities:
                            - string
                        subsystemNames:
                            - operation: string
                              value: string
                    luceneQuery: string
            notificationPayloadFilters:
                - string
            rules:
                - condition:
                    threshold: 0
                    timeWindow:
                        logsTimeWindowSpecificValue: string
                  override:
                    priority: string
            undetectedValuesManagement:
                autoRetireTimeframe: string
                triggerUndetectedValues: false
        logsTimeRelativeThreshold:
            conditionType: string
            evaluationDelayMs: 0
            ignoreInfinity: false
            logsFilter:
                simpleFilter:
                    labelFilters:
                        applicationNames:
                            - operation: string
                              value: string
                        severities:
                            - string
                        subsystemNames:
                            - operation: string
                              value: string
                    luceneQuery: string
            notificationPayloadFilters:
                - string
            rules:
                - condition:
                    comparedTo: string
                    threshold: 0
                  override:
                    priority: string
            undetectedValuesManagement:
                autoRetireTimeframe: string
                triggerUndetectedValues: false
        logsUniqueCount:
            logsFilter:
                simpleFilter:
                    labelFilters:
                        applicationNames:
                            - operation: string
                              value: string
                        severities:
                            - string
                        subsystemNames:
                            - operation: string
                              value: string
                    luceneQuery: string
            maxUniqueCountPerGroupByKey: string
            notificationPayloadFilters:
                - string
            rules:
                - condition:
                    maxUniqueCount: string
                    timeWindow:
                        logsUniqueValueTimeWindowSpecificValue: string
            uniqueCountKeypath: string
        metricAnomaly:
            anomalyAlertSettings:
                percentageOfDeviation: 0
            conditionType: string
            evaluationDelayMs: 0
            metricFilter:
                promql: string
            rules:
                - condition:
                    forOverPct: 0
                    minNonNullValuesPct: 0
                    ofTheLast:
                        metricTimeWindowDynamicDuration: string
                        metricTimeWindowSpecificValue: string
                    threshold: 0
        metricThreshold:
            conditionType: string
            evaluationDelayMs: 0
            metricFilter:
                promql: string
            missingValues:
                minNonNullValuesPct: 0
                replaceWithZero: false
            rules:
                - condition:
                    forOverPct: 0
                    ofTheLast:
                        metricTimeWindowDynamicDuration: string
                        metricTimeWindowSpecificValue: string
                    threshold: 0
                  override:
                    priority: string
            undetectedValuesManagement:
                autoRetireTimeframe: string
                triggerUndetectedValues: false
        name: string
        notificationGroup:
            groupByKeys:
                - string
            webhooks:
                - integration:
                    integrationId: 0
                  minutes: 0
                  notifyOn: string
        phantomMode: false
        priority: string
        region: string
        type: string
    

    LogsAlertDefinition Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The LogsAlertDefinition resource accepts the following input properties:

    InstanceId string
    Cloud Logs Instance GUID.
    Type string
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    ActiveOn LogsAlertDefinitionActiveOn
    Defining when the alert is active. Nested schema for active_on:
    Deleted bool
    Whether the alert has been marked as deleted.
    Description string
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    Enabled bool
    Whether the alert is currently active and monitoring. If true, alert is active.
    EndpointType string
    public or private.
    EntityLabels Dictionary<string, string>
    Labels used to identify and categorize the alert entity.
    Flow LogsAlertDefinitionFlow
    Configuration for flow alerts. Nested schema for flow:
    GroupByKeys List<string>
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    IncidentsSettings LogsAlertDefinitionIncidentsSettings
    Incident creation and management settings. Nested schema for incidents_settings:
    LogsAlertDefinitionId string
    The unique identifier of the logs_alert_definition.
    LogsAnomaly LogsAlertDefinitionLogsAnomaly
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    LogsImmediate LogsAlertDefinitionLogsImmediate
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    LogsNewValue LogsAlertDefinitionLogsNewValue
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    LogsRatioThreshold LogsAlertDefinitionLogsRatioThreshold
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    LogsThreshold LogsAlertDefinitionLogsThreshold
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    LogsTimeRelativeThreshold LogsAlertDefinitionLogsTimeRelativeThreshold
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    LogsUniqueCount LogsAlertDefinitionLogsUniqueCount
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    MetricAnomaly LogsAlertDefinitionMetricAnomaly
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    MetricThreshold LogsAlertDefinitionMetricThreshold
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    Name string
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    NotificationGroup LogsAlertDefinitionNotificationGroup
    Primary notification group for alert events. Nested schema for notification_group:
    PhantomMode bool
    Whether the alert is in phantom mode (creating incidents or not).
    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    Region string
    Cloud Logs Instance Region.
    InstanceId string
    Cloud Logs Instance GUID.
    Type string
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    ActiveOn LogsAlertDefinitionActiveOnArgs
    Defining when the alert is active. Nested schema for active_on:
    Deleted bool
    Whether the alert has been marked as deleted.
    Description string
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    Enabled bool
    Whether the alert is currently active and monitoring. If true, alert is active.
    EndpointType string
    public or private.
    EntityLabels map[string]string
    Labels used to identify and categorize the alert entity.
    Flow LogsAlertDefinitionFlowArgs
    Configuration for flow alerts. Nested schema for flow:
    GroupByKeys []string
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    IncidentsSettings LogsAlertDefinitionIncidentsSettingsArgs
    Incident creation and management settings. Nested schema for incidents_settings:
    LogsAlertDefinitionId string
    The unique identifier of the logs_alert_definition.
    LogsAnomaly LogsAlertDefinitionLogsAnomalyArgs
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    LogsImmediate LogsAlertDefinitionLogsImmediateArgs
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    LogsNewValue LogsAlertDefinitionLogsNewValueArgs
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    LogsRatioThreshold LogsAlertDefinitionLogsRatioThresholdArgs
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    LogsThreshold LogsAlertDefinitionLogsThresholdArgs
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    LogsTimeRelativeThreshold LogsAlertDefinitionLogsTimeRelativeThresholdArgs
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    LogsUniqueCount LogsAlertDefinitionLogsUniqueCountArgs
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    MetricAnomaly LogsAlertDefinitionMetricAnomalyArgs
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    MetricThreshold LogsAlertDefinitionMetricThresholdArgs
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    Name string
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    NotificationGroup LogsAlertDefinitionNotificationGroupArgs
    Primary notification group for alert events. Nested schema for notification_group:
    PhantomMode bool
    Whether the alert is in phantom mode (creating incidents or not).
    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    Region string
    Cloud Logs Instance Region.
    instanceId String
    Cloud Logs Instance GUID.
    type String
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    activeOn LogsAlertDefinitionActiveOn
    Defining when the alert is active. Nested schema for active_on:
    deleted Boolean
    Whether the alert has been marked as deleted.
    description String
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    enabled Boolean
    Whether the alert is currently active and monitoring. If true, alert is active.
    endpointType String
    public or private.
    entityLabels Map<String,String>
    Labels used to identify and categorize the alert entity.
    flow LogsAlertDefinitionFlow
    Configuration for flow alerts. Nested schema for flow:
    groupByKeys List<String>
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    incidentsSettings LogsAlertDefinitionIncidentsSettings
    Incident creation and management settings. Nested schema for incidents_settings:
    logsAlertDefinitionId String
    The unique identifier of the logs_alert_definition.
    logsAnomaly LogsAlertDefinitionLogsAnomaly
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    logsImmediate LogsAlertDefinitionLogsImmediate
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    logsNewValue LogsAlertDefinitionLogsNewValue
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    logsRatioThreshold LogsAlertDefinitionLogsRatioThreshold
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    logsThreshold LogsAlertDefinitionLogsThreshold
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    logsTimeRelativeThreshold LogsAlertDefinitionLogsTimeRelativeThreshold
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    logsUniqueCount LogsAlertDefinitionLogsUniqueCount
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    metricAnomaly LogsAlertDefinitionMetricAnomaly
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    metricThreshold LogsAlertDefinitionMetricThreshold
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    name String
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    notificationGroup LogsAlertDefinitionNotificationGroup
    Primary notification group for alert events. Nested schema for notification_group:
    phantomMode Boolean
    Whether the alert is in phantom mode (creating incidents or not).
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    region String
    Cloud Logs Instance Region.
    instanceId string
    Cloud Logs Instance GUID.
    type string
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    activeOn LogsAlertDefinitionActiveOn
    Defining when the alert is active. Nested schema for active_on:
    deleted boolean
    Whether the alert has been marked as deleted.
    description string
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    enabled boolean
    Whether the alert is currently active and monitoring. If true, alert is active.
    endpointType string
    public or private.
    entityLabels {[key: string]: string}
    Labels used to identify and categorize the alert entity.
    flow LogsAlertDefinitionFlow
    Configuration for flow alerts. Nested schema for flow:
    groupByKeys string[]
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    incidentsSettings LogsAlertDefinitionIncidentsSettings
    Incident creation and management settings. Nested schema for incidents_settings:
    logsAlertDefinitionId string
    The unique identifier of the logs_alert_definition.
    logsAnomaly LogsAlertDefinitionLogsAnomaly
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    logsImmediate LogsAlertDefinitionLogsImmediate
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    logsNewValue LogsAlertDefinitionLogsNewValue
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    logsRatioThreshold LogsAlertDefinitionLogsRatioThreshold
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    logsThreshold LogsAlertDefinitionLogsThreshold
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    logsTimeRelativeThreshold LogsAlertDefinitionLogsTimeRelativeThreshold
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    logsUniqueCount LogsAlertDefinitionLogsUniqueCount
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    metricAnomaly LogsAlertDefinitionMetricAnomaly
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    metricThreshold LogsAlertDefinitionMetricThreshold
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    name string
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    notificationGroup LogsAlertDefinitionNotificationGroup
    Primary notification group for alert events. Nested schema for notification_group:
    phantomMode boolean
    Whether the alert is in phantom mode (creating incidents or not).
    priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    region string
    Cloud Logs Instance Region.
    instance_id str
    Cloud Logs Instance GUID.
    type str
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    active_on LogsAlertDefinitionActiveOnArgs
    Defining when the alert is active. Nested schema for active_on:
    deleted bool
    Whether the alert has been marked as deleted.
    description str
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    enabled bool
    Whether the alert is currently active and monitoring. If true, alert is active.
    endpoint_type str
    public or private.
    entity_labels Mapping[str, str]
    Labels used to identify and categorize the alert entity.
    flow LogsAlertDefinitionFlowArgs
    Configuration for flow alerts. Nested schema for flow:
    group_by_keys Sequence[str]
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    incidents_settings LogsAlertDefinitionIncidentsSettingsArgs
    Incident creation and management settings. Nested schema for incidents_settings:
    logs_alert_definition_id str
    The unique identifier of the logs_alert_definition.
    logs_anomaly LogsAlertDefinitionLogsAnomalyArgs
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    logs_immediate LogsAlertDefinitionLogsImmediateArgs
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    logs_new_value LogsAlertDefinitionLogsNewValueArgs
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    logs_ratio_threshold LogsAlertDefinitionLogsRatioThresholdArgs
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    logs_threshold LogsAlertDefinitionLogsThresholdArgs
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    logs_time_relative_threshold LogsAlertDefinitionLogsTimeRelativeThresholdArgs
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    logs_unique_count LogsAlertDefinitionLogsUniqueCountArgs
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    metric_anomaly LogsAlertDefinitionMetricAnomalyArgs
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    metric_threshold LogsAlertDefinitionMetricThresholdArgs
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    name str
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    notification_group LogsAlertDefinitionNotificationGroupArgs
    Primary notification group for alert events. Nested schema for notification_group:
    phantom_mode bool
    Whether the alert is in phantom mode (creating incidents or not).
    priority str
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    region str
    Cloud Logs Instance Region.
    instanceId String
    Cloud Logs Instance GUID.
    type String
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    activeOn Property Map
    Defining when the alert is active. Nested schema for active_on:
    deleted Boolean
    Whether the alert has been marked as deleted.
    description String
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    enabled Boolean
    Whether the alert is currently active and monitoring. If true, alert is active.
    endpointType String
    public or private.
    entityLabels Map<String>
    Labels used to identify and categorize the alert entity.
    flow Property Map
    Configuration for flow alerts. Nested schema for flow:
    groupByKeys List<String>
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    incidentsSettings Property Map
    Incident creation and management settings. Nested schema for incidents_settings:
    logsAlertDefinitionId String
    The unique identifier of the logs_alert_definition.
    logsAnomaly Property Map
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    logsImmediate Property Map
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    logsNewValue Property Map
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    logsRatioThreshold Property Map
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    logsThreshold Property Map
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    logsTimeRelativeThreshold Property Map
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    logsUniqueCount Property Map
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    metricAnomaly Property Map
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    metricThreshold Property Map
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    name String
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    notificationGroup Property Map
    Primary notification group for alert events. Nested schema for notification_group:
    phantomMode Boolean
    Whether the alert is in phantom mode (creating incidents or not).
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    region String
    Cloud Logs Instance Region.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the LogsAlertDefinition resource produces the following output properties:

    AlertDefId string
    The unique identifier of the alert definition.
    AlertVersionId string
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    CreatedTime string
    (String) The time when the alert definition was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedTime string
    (String) The time when the alert definition was last updated.
    AlertDefId string
    The unique identifier of the alert definition.
    AlertVersionId string
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    CreatedTime string
    (String) The time when the alert definition was created.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdatedTime string
    (String) The time when the alert definition was last updated.
    alertDefId String
    The unique identifier of the alert definition.
    alertVersionId String
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    createdTime String
    (String) The time when the alert definition was created.
    id String
    The provider-assigned unique ID for this managed resource.
    updatedTime String
    (String) The time when the alert definition was last updated.
    alertDefId string
    The unique identifier of the alert definition.
    alertVersionId string
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    createdTime string
    (String) The time when the alert definition was created.
    id string
    The provider-assigned unique ID for this managed resource.
    updatedTime string
    (String) The time when the alert definition was last updated.
    alert_def_id str
    The unique identifier of the alert definition.
    alert_version_id str
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    created_time str
    (String) The time when the alert definition was created.
    id str
    The provider-assigned unique ID for this managed resource.
    updated_time str
    (String) The time when the alert definition was last updated.
    alertDefId String
    The unique identifier of the alert definition.
    alertVersionId String
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    createdTime String
    (String) The time when the alert definition was created.
    id String
    The provider-assigned unique ID for this managed resource.
    updatedTime String
    (String) The time when the alert definition was last updated.

    Look up Existing LogsAlertDefinition Resource

    Get an existing LogsAlertDefinition resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: LogsAlertDefinitionState, opts?: CustomResourceOptions): LogsAlertDefinition
    @staticmethod
    def get(resource_name: str,
            id: str,
            opts: Optional[ResourceOptions] = None,
            active_on: Optional[LogsAlertDefinitionActiveOnArgs] = None,
            alert_def_id: Optional[str] = None,
            alert_version_id: Optional[str] = None,
            created_time: Optional[str] = None,
            deleted: Optional[bool] = None,
            description: Optional[str] = None,
            enabled: Optional[bool] = None,
            endpoint_type: Optional[str] = None,
            entity_labels: Optional[Mapping[str, str]] = None,
            flow: Optional[LogsAlertDefinitionFlowArgs] = None,
            group_by_keys: Optional[Sequence[str]] = None,
            incidents_settings: Optional[LogsAlertDefinitionIncidentsSettingsArgs] = None,
            instance_id: Optional[str] = None,
            logs_alert_definition_id: Optional[str] = None,
            logs_anomaly: Optional[LogsAlertDefinitionLogsAnomalyArgs] = None,
            logs_immediate: Optional[LogsAlertDefinitionLogsImmediateArgs] = None,
            logs_new_value: Optional[LogsAlertDefinitionLogsNewValueArgs] = None,
            logs_ratio_threshold: Optional[LogsAlertDefinitionLogsRatioThresholdArgs] = None,
            logs_threshold: Optional[LogsAlertDefinitionLogsThresholdArgs] = None,
            logs_time_relative_threshold: Optional[LogsAlertDefinitionLogsTimeRelativeThresholdArgs] = None,
            logs_unique_count: Optional[LogsAlertDefinitionLogsUniqueCountArgs] = None,
            metric_anomaly: Optional[LogsAlertDefinitionMetricAnomalyArgs] = None,
            metric_threshold: Optional[LogsAlertDefinitionMetricThresholdArgs] = None,
            name: Optional[str] = None,
            notification_group: Optional[LogsAlertDefinitionNotificationGroupArgs] = None,
            phantom_mode: Optional[bool] = None,
            priority: Optional[str] = None,
            region: Optional[str] = None,
            type: Optional[str] = None,
            updated_time: Optional[str] = None) -> LogsAlertDefinition
    func GetLogsAlertDefinition(ctx *Context, name string, id IDInput, state *LogsAlertDefinitionState, opts ...ResourceOption) (*LogsAlertDefinition, error)
    public static LogsAlertDefinition Get(string name, Input<string> id, LogsAlertDefinitionState? state, CustomResourceOptions? opts = null)
    public static LogsAlertDefinition get(String name, Output<String> id, LogsAlertDefinitionState state, CustomResourceOptions options)
    resources:  _:    type: ibm:LogsAlertDefinition    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ActiveOn LogsAlertDefinitionActiveOn
    Defining when the alert is active. Nested schema for active_on:
    AlertDefId string
    The unique identifier of the alert definition.
    AlertVersionId string
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    CreatedTime string
    (String) The time when the alert definition was created.
    Deleted bool
    Whether the alert has been marked as deleted.
    Description string
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    Enabled bool
    Whether the alert is currently active and monitoring. If true, alert is active.
    EndpointType string
    public or private.
    EntityLabels Dictionary<string, string>
    Labels used to identify and categorize the alert entity.
    Flow LogsAlertDefinitionFlow
    Configuration for flow alerts. Nested schema for flow:
    GroupByKeys List<string>
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    IncidentsSettings LogsAlertDefinitionIncidentsSettings
    Incident creation and management settings. Nested schema for incidents_settings:
    InstanceId string
    Cloud Logs Instance GUID.
    LogsAlertDefinitionId string
    The unique identifier of the logs_alert_definition.
    LogsAnomaly LogsAlertDefinitionLogsAnomaly
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    LogsImmediate LogsAlertDefinitionLogsImmediate
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    LogsNewValue LogsAlertDefinitionLogsNewValue
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    LogsRatioThreshold LogsAlertDefinitionLogsRatioThreshold
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    LogsThreshold LogsAlertDefinitionLogsThreshold
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    LogsTimeRelativeThreshold LogsAlertDefinitionLogsTimeRelativeThreshold
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    LogsUniqueCount LogsAlertDefinitionLogsUniqueCount
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    MetricAnomaly LogsAlertDefinitionMetricAnomaly
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    MetricThreshold LogsAlertDefinitionMetricThreshold
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    Name string
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    NotificationGroup LogsAlertDefinitionNotificationGroup
    Primary notification group for alert events. Nested schema for notification_group:
    PhantomMode bool
    Whether the alert is in phantom mode (creating incidents or not).
    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    Region string
    Cloud Logs Instance Region.
    Type string
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    UpdatedTime string
    (String) The time when the alert definition was last updated.
    ActiveOn LogsAlertDefinitionActiveOnArgs
    Defining when the alert is active. Nested schema for active_on:
    AlertDefId string
    The unique identifier of the alert definition.
    AlertVersionId string
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    CreatedTime string
    (String) The time when the alert definition was created.
    Deleted bool
    Whether the alert has been marked as deleted.
    Description string
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    Enabled bool
    Whether the alert is currently active and monitoring. If true, alert is active.
    EndpointType string
    public or private.
    EntityLabels map[string]string
    Labels used to identify and categorize the alert entity.
    Flow LogsAlertDefinitionFlowArgs
    Configuration for flow alerts. Nested schema for flow:
    GroupByKeys []string
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    IncidentsSettings LogsAlertDefinitionIncidentsSettingsArgs
    Incident creation and management settings. Nested schema for incidents_settings:
    InstanceId string
    Cloud Logs Instance GUID.
    LogsAlertDefinitionId string
    The unique identifier of the logs_alert_definition.
    LogsAnomaly LogsAlertDefinitionLogsAnomalyArgs
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    LogsImmediate LogsAlertDefinitionLogsImmediateArgs
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    LogsNewValue LogsAlertDefinitionLogsNewValueArgs
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    LogsRatioThreshold LogsAlertDefinitionLogsRatioThresholdArgs
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    LogsThreshold LogsAlertDefinitionLogsThresholdArgs
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    LogsTimeRelativeThreshold LogsAlertDefinitionLogsTimeRelativeThresholdArgs
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    LogsUniqueCount LogsAlertDefinitionLogsUniqueCountArgs
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    MetricAnomaly LogsAlertDefinitionMetricAnomalyArgs
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    MetricThreshold LogsAlertDefinitionMetricThresholdArgs
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    Name string
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    NotificationGroup LogsAlertDefinitionNotificationGroupArgs
    Primary notification group for alert events. Nested schema for notification_group:
    PhantomMode bool
    Whether the alert is in phantom mode (creating incidents or not).
    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    Region string
    Cloud Logs Instance Region.
    Type string
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    UpdatedTime string
    (String) The time when the alert definition was last updated.
    activeOn LogsAlertDefinitionActiveOn
    Defining when the alert is active. Nested schema for active_on:
    alertDefId String
    The unique identifier of the alert definition.
    alertVersionId String
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    createdTime String
    (String) The time when the alert definition was created.
    deleted Boolean
    Whether the alert has been marked as deleted.
    description String
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    enabled Boolean
    Whether the alert is currently active and monitoring. If true, alert is active.
    endpointType String
    public or private.
    entityLabels Map<String,String>
    Labels used to identify and categorize the alert entity.
    flow LogsAlertDefinitionFlow
    Configuration for flow alerts. Nested schema for flow:
    groupByKeys List<String>
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    incidentsSettings LogsAlertDefinitionIncidentsSettings
    Incident creation and management settings. Nested schema for incidents_settings:
    instanceId String
    Cloud Logs Instance GUID.
    logsAlertDefinitionId String
    The unique identifier of the logs_alert_definition.
    logsAnomaly LogsAlertDefinitionLogsAnomaly
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    logsImmediate LogsAlertDefinitionLogsImmediate
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    logsNewValue LogsAlertDefinitionLogsNewValue
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    logsRatioThreshold LogsAlertDefinitionLogsRatioThreshold
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    logsThreshold LogsAlertDefinitionLogsThreshold
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    logsTimeRelativeThreshold LogsAlertDefinitionLogsTimeRelativeThreshold
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    logsUniqueCount LogsAlertDefinitionLogsUniqueCount
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    metricAnomaly LogsAlertDefinitionMetricAnomaly
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    metricThreshold LogsAlertDefinitionMetricThreshold
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    name String
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    notificationGroup LogsAlertDefinitionNotificationGroup
    Primary notification group for alert events. Nested schema for notification_group:
    phantomMode Boolean
    Whether the alert is in phantom mode (creating incidents or not).
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    region String
    Cloud Logs Instance Region.
    type String
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    updatedTime String
    (String) The time when the alert definition was last updated.
    activeOn LogsAlertDefinitionActiveOn
    Defining when the alert is active. Nested schema for active_on:
    alertDefId string
    The unique identifier of the alert definition.
    alertVersionId string
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    createdTime string
    (String) The time when the alert definition was created.
    deleted boolean
    Whether the alert has been marked as deleted.
    description string
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    enabled boolean
    Whether the alert is currently active and monitoring. If true, alert is active.
    endpointType string
    public or private.
    entityLabels {[key: string]: string}
    Labels used to identify and categorize the alert entity.
    flow LogsAlertDefinitionFlow
    Configuration for flow alerts. Nested schema for flow:
    groupByKeys string[]
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    incidentsSettings LogsAlertDefinitionIncidentsSettings
    Incident creation and management settings. Nested schema for incidents_settings:
    instanceId string
    Cloud Logs Instance GUID.
    logsAlertDefinitionId string
    The unique identifier of the logs_alert_definition.
    logsAnomaly LogsAlertDefinitionLogsAnomaly
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    logsImmediate LogsAlertDefinitionLogsImmediate
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    logsNewValue LogsAlertDefinitionLogsNewValue
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    logsRatioThreshold LogsAlertDefinitionLogsRatioThreshold
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    logsThreshold LogsAlertDefinitionLogsThreshold
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    logsTimeRelativeThreshold LogsAlertDefinitionLogsTimeRelativeThreshold
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    logsUniqueCount LogsAlertDefinitionLogsUniqueCount
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    metricAnomaly LogsAlertDefinitionMetricAnomaly
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    metricThreshold LogsAlertDefinitionMetricThreshold
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    name string
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    notificationGroup LogsAlertDefinitionNotificationGroup
    Primary notification group for alert events. Nested schema for notification_group:
    phantomMode boolean
    Whether the alert is in phantom mode (creating incidents or not).
    priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    region string
    Cloud Logs Instance Region.
    type string
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    updatedTime string
    (String) The time when the alert definition was last updated.
    active_on LogsAlertDefinitionActiveOnArgs
    Defining when the alert is active. Nested schema for active_on:
    alert_def_id str
    The unique identifier of the alert definition.
    alert_version_id str
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    created_time str
    (String) The time when the alert definition was created.
    deleted bool
    Whether the alert has been marked as deleted.
    description str
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    enabled bool
    Whether the alert is currently active and monitoring. If true, alert is active.
    endpoint_type str
    public or private.
    entity_labels Mapping[str, str]
    Labels used to identify and categorize the alert entity.
    flow LogsAlertDefinitionFlowArgs
    Configuration for flow alerts. Nested schema for flow:
    group_by_keys Sequence[str]
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    incidents_settings LogsAlertDefinitionIncidentsSettingsArgs
    Incident creation and management settings. Nested schema for incidents_settings:
    instance_id str
    Cloud Logs Instance GUID.
    logs_alert_definition_id str
    The unique identifier of the logs_alert_definition.
    logs_anomaly LogsAlertDefinitionLogsAnomalyArgs
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    logs_immediate LogsAlertDefinitionLogsImmediateArgs
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    logs_new_value LogsAlertDefinitionLogsNewValueArgs
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    logs_ratio_threshold LogsAlertDefinitionLogsRatioThresholdArgs
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    logs_threshold LogsAlertDefinitionLogsThresholdArgs
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    logs_time_relative_threshold LogsAlertDefinitionLogsTimeRelativeThresholdArgs
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    logs_unique_count LogsAlertDefinitionLogsUniqueCountArgs
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    metric_anomaly LogsAlertDefinitionMetricAnomalyArgs
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    metric_threshold LogsAlertDefinitionMetricThresholdArgs
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    name str
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    notification_group LogsAlertDefinitionNotificationGroupArgs
    Primary notification group for alert events. Nested schema for notification_group:
    phantom_mode bool
    Whether the alert is in phantom mode (creating incidents or not).
    priority str
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    region str
    Cloud Logs Instance Region.
    type str
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    updated_time str
    (String) The time when the alert definition was last updated.
    activeOn Property Map
    Defining when the alert is active. Nested schema for active_on:
    alertDefId String
    The unique identifier of the alert definition.
    alertVersionId String
    (String) The previous or old alert ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    createdTime String
    (String) The time when the alert definition was created.
    deleted Boolean
    Whether the alert has been marked as deleted.
    description String
    A detailed description of what the alert monitors and when it triggers.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    enabled Boolean
    Whether the alert is currently active and monitoring. If true, alert is active.
    endpointType String
    public or private.
    entityLabels Map<String>
    Labels used to identify and categorize the alert entity.
    flow Property Map
    Configuration for flow alerts. Nested schema for flow:
    groupByKeys List<String>
    Keys used to group and aggregate alert data.

    • Constraints: The list items must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/. The maximum length is 2 items. The minimum length is 0 items.
    incidentsSettings Property Map
    Incident creation and management settings. Nested schema for incidents_settings:
    instanceId String
    Cloud Logs Instance GUID.
    logsAlertDefinitionId String
    The unique identifier of the logs_alert_definition.
    logsAnomaly Property Map
    Configuration for the log-based anomaly detection alerts. Nested schema for logs_anomaly:
    logsImmediate Property Map
    Configuration for immediate log-based alerts. Nested schema for logs_immediate:
    logsNewValue Property Map
    Configuration for alerts triggered by new log values. Nested schema for logs_new_value:
    logsRatioThreshold Property Map
    Configuration for the log-based ratio threshold alerts. Nested schema for logs_ratio_threshold:
    logsThreshold Property Map
    Configuration for the log-based threshold alerts. Nested schema for logs_threshold:
    logsTimeRelativeThreshold Property Map
    Configuration for time-relative log threshold alerts. Nested schema for logs_time_relative_threshold:
    logsUniqueCount Property Map
    Configuration for alerts based on unique log value counts. Nested schema for logs_unique_count:
    metricAnomaly Property Map
    Configuration for metric-based anomaly detection alerts. Nested schema for metric_anomaly:
    metricThreshold Property Map
    Configuration for metric-based threshold alerts. Nested schema for metric_threshold:
    name String
    The name of the alert definition.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    notificationGroup Property Map
    Primary notification group for alert events. Nested schema for notification_group:
    phantomMode Boolean
    Whether the alert is in phantom mode (creating incidents or not).
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    region String
    Cloud Logs Instance Region.
    type String
    Alert type.

    • Constraints: Allowable values are: logs_immediate_or_unspecified, logs_threshold, logs_anomaly, logs_ratio_threshold, logs_new_value, logs_unique_count, logs_time_relative_threshold, metric_threshold, metric_anomaly, flow.
    updatedTime String
    (String) The time when the alert definition was last updated.

    Supporting Types

    LogsAlertDefinitionActiveOn, LogsAlertDefinitionActiveOnArgs

    DayOfWeeks List<string>
    Days of the week when the alert is active.

    • Constraints: Allowable list items are: monday_or_unspecified, tuesday, wednesday, thursday, friday, saturday, sunday. The maximum length is 7 items. The minimum length is 1 item.
    EndTime LogsAlertDefinitionActiveOnEndTime
    Start time of the alert activity. Nested schema for end_time:
    StartTime LogsAlertDefinitionActiveOnStartTime
    Start time of the alert activity. Nested schema for start_time:
    DayOfWeeks []string
    Days of the week when the alert is active.

    • Constraints: Allowable list items are: monday_or_unspecified, tuesday, wednesday, thursday, friday, saturday, sunday. The maximum length is 7 items. The minimum length is 1 item.
    EndTime LogsAlertDefinitionActiveOnEndTime
    Start time of the alert activity. Nested schema for end_time:
    StartTime LogsAlertDefinitionActiveOnStartTime
    Start time of the alert activity. Nested schema for start_time:
    dayOfWeeks List<String>
    Days of the week when the alert is active.

    • Constraints: Allowable list items are: monday_or_unspecified, tuesday, wednesday, thursday, friday, saturday, sunday. The maximum length is 7 items. The minimum length is 1 item.
    endTime LogsAlertDefinitionActiveOnEndTime
    Start time of the alert activity. Nested schema for end_time:
    startTime LogsAlertDefinitionActiveOnStartTime
    Start time of the alert activity. Nested schema for start_time:
    dayOfWeeks string[]
    Days of the week when the alert is active.

    • Constraints: Allowable list items are: monday_or_unspecified, tuesday, wednesday, thursday, friday, saturday, sunday. The maximum length is 7 items. The minimum length is 1 item.
    endTime LogsAlertDefinitionActiveOnEndTime
    Start time of the alert activity. Nested schema for end_time:
    startTime LogsAlertDefinitionActiveOnStartTime
    Start time of the alert activity. Nested schema for start_time:
    day_of_weeks Sequence[str]
    Days of the week when the alert is active.

    • Constraints: Allowable list items are: monday_or_unspecified, tuesday, wednesday, thursday, friday, saturday, sunday. The maximum length is 7 items. The minimum length is 1 item.
    end_time LogsAlertDefinitionActiveOnEndTime
    Start time of the alert activity. Nested schema for end_time:
    start_time LogsAlertDefinitionActiveOnStartTime
    Start time of the alert activity. Nested schema for start_time:
    dayOfWeeks List<String>
    Days of the week when the alert is active.

    • Constraints: Allowable list items are: monday_or_unspecified, tuesday, wednesday, thursday, friday, saturday, sunday. The maximum length is 7 items. The minimum length is 1 item.
    endTime Property Map
    Start time of the alert activity. Nested schema for end_time:
    startTime Property Map
    Start time of the alert activity. Nested schema for start_time:

    LogsAlertDefinitionActiveOnEndTime, LogsAlertDefinitionActiveOnEndTimeArgs

    Hours double
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    Minutes double
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    Hours float64
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    Minutes float64
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    hours Double
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    minutes Double
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    hours number
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    minutes number
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    hours float
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    minutes float
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    hours Number
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    minutes Number
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.

    LogsAlertDefinitionActiveOnStartTime, LogsAlertDefinitionActiveOnStartTimeArgs

    Hours double
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    Minutes double
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    Hours float64
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    Minutes float64
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    hours Double
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    minutes Double
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    hours number
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    minutes number
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    hours float
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    minutes float
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.
    hours Number
    The hour of the day in 24-hour format. Must be an integer between 0 and 23.

    • Constraints: The maximum value is 23. The minimum value is 0.
    minutes Number
    Minute of the hour of the day. Must be an integer between 0 and 59.

    • Constraints: The maximum value is 59. The minimum value is 0.

    LogsAlertDefinitionFlow, LogsAlertDefinitionFlowArgs

    Stages List<LogsAlertDefinitionFlowStage>
    The definition of stages of the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for stages:
    EnforceSuppression bool
    Whether to enforce suppression for the flow alert.
    Stages []LogsAlertDefinitionFlowStage
    The definition of stages of the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for stages:
    EnforceSuppression bool
    Whether to enforce suppression for the flow alert.
    stages List<LogsAlertDefinitionFlowStage>
    The definition of stages of the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for stages:
    enforceSuppression Boolean
    Whether to enforce suppression for the flow alert.
    stages LogsAlertDefinitionFlowStage[]
    The definition of stages of the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for stages:
    enforceSuppression boolean
    Whether to enforce suppression for the flow alert.
    stages Sequence[LogsAlertDefinitionFlowStage]
    The definition of stages of the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for stages:
    enforce_suppression bool
    Whether to enforce suppression for the flow alert.
    stages List<Property Map>
    The definition of stages of the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for stages:
    enforceSuppression Boolean
    Whether to enforce suppression for the flow alert.

    LogsAlertDefinitionFlowStage, LogsAlertDefinitionFlowStageArgs

    FlowStagesGroups LogsAlertDefinitionFlowStageFlowStagesGroups
    The definition of groups in the flow alert. Nested schema for flow_stages_groups:
    TimeframeMs string
    The timeframe for the flow alert in milliseconds.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    TimeframeType string
    The type of timeframe for the flow alert.

    • Constraints: Allowable values are: unspecified, up_to.
    FlowStagesGroups LogsAlertDefinitionFlowStageFlowStagesGroups
    The definition of groups in the flow alert. Nested schema for flow_stages_groups:
    TimeframeMs string
    The timeframe for the flow alert in milliseconds.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    TimeframeType string
    The type of timeframe for the flow alert.

    • Constraints: Allowable values are: unspecified, up_to.
    flowStagesGroups LogsAlertDefinitionFlowStageFlowStagesGroups
    The definition of groups in the flow alert. Nested schema for flow_stages_groups:
    timeframeMs String
    The timeframe for the flow alert in milliseconds.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    timeframeType String
    The type of timeframe for the flow alert.

    • Constraints: Allowable values are: unspecified, up_to.
    flowStagesGroups LogsAlertDefinitionFlowStageFlowStagesGroups
    The definition of groups in the flow alert. Nested schema for flow_stages_groups:
    timeframeMs string
    The timeframe for the flow alert in milliseconds.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    timeframeType string
    The type of timeframe for the flow alert.

    • Constraints: Allowable values are: unspecified, up_to.
    flow_stages_groups LogsAlertDefinitionFlowStageFlowStagesGroups
    The definition of groups in the flow alert. Nested schema for flow_stages_groups:
    timeframe_ms str
    The timeframe for the flow alert in milliseconds.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    timeframe_type str
    The type of timeframe for the flow alert.

    • Constraints: Allowable values are: unspecified, up_to.
    flowStagesGroups Property Map
    The definition of groups in the flow alert. Nested schema for flow_stages_groups:
    timeframeMs String
    The timeframe for the flow alert in milliseconds.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    timeframeType String
    The type of timeframe for the flow alert.

    • Constraints: Allowable values are: unspecified, up_to.

    LogsAlertDefinitionFlowStageFlowStagesGroups, LogsAlertDefinitionFlowStageFlowStagesGroupsArgs

    Groups List<LogsAlertDefinitionFlowStageFlowStagesGroupsGroup>
    The definition of an array of groups with alerts and logical operation among those alerts in the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for groups:
    Groups []LogsAlertDefinitionFlowStageFlowStagesGroupsGroup
    The definition of an array of groups with alerts and logical operation among those alerts in the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for groups:
    groups List<LogsAlertDefinitionFlowStageFlowStagesGroupsGroup>
    The definition of an array of groups with alerts and logical operation among those alerts in the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for groups:
    groups LogsAlertDefinitionFlowStageFlowStagesGroupsGroup[]
    The definition of an array of groups with alerts and logical operation among those alerts in the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for groups:
    groups Sequence[LogsAlertDefinitionFlowStageFlowStagesGroupsGroup]
    The definition of an array of groups with alerts and logical operation among those alerts in the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for groups:
    groups List<Property Map>
    The definition of an array of groups with alerts and logical operation among those alerts in the flow alert.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for groups:

    LogsAlertDefinitionFlowStageFlowStagesGroupsGroup, LogsAlertDefinitionFlowStageFlowStagesGroupsGroupArgs

    AlertDefs List<LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDef>
    The alert definitions for the flow stage group.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for alert_defs:
    AlertsOp string
    The logical operation to apply to the alerts in the group.

    • Constraints: Allowable values are: and_or_unspecified, or.
    NextOp string
    The logical operation to apply to the next stage.

    • Constraints: Allowable values are: and_or_unspecified, or.
    AlertDefs []LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDef
    The alert definitions for the flow stage group.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for alert_defs:
    AlertsOp string
    The logical operation to apply to the alerts in the group.

    • Constraints: Allowable values are: and_or_unspecified, or.
    NextOp string
    The logical operation to apply to the next stage.

    • Constraints: Allowable values are: and_or_unspecified, or.
    alertDefs List<LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDef>
    The alert definitions for the flow stage group.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for alert_defs:
    alertsOp String
    The logical operation to apply to the alerts in the group.

    • Constraints: Allowable values are: and_or_unspecified, or.
    nextOp String
    The logical operation to apply to the next stage.

    • Constraints: Allowable values are: and_or_unspecified, or.
    alertDefs LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDef[]
    The alert definitions for the flow stage group.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for alert_defs:
    alertsOp string
    The logical operation to apply to the alerts in the group.

    • Constraints: Allowable values are: and_or_unspecified, or.
    nextOp string
    The logical operation to apply to the next stage.

    • Constraints: Allowable values are: and_or_unspecified, or.
    alert_defs Sequence[LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDef]
    The alert definitions for the flow stage group.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for alert_defs:
    alerts_op str
    The logical operation to apply to the alerts in the group.

    • Constraints: Allowable values are: and_or_unspecified, or.
    next_op str
    The logical operation to apply to the next stage.

    • Constraints: Allowable values are: and_or_unspecified, or.
    alertDefs List<Property Map>
    The alert definitions for the flow stage group.

    • Constraints: The maximum length is 4096 items. The minimum length is 1 item. Nested schema for alert_defs:
    alertsOp String
    The logical operation to apply to the alerts in the group.

    • Constraints: Allowable values are: and_or_unspecified, or.
    nextOp String
    The logical operation to apply to the next stage.

    • Constraints: Allowable values are: and_or_unspecified, or.

    LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDef, LogsAlertDefinitionFlowStageFlowStagesGroupsGroupAlertDefArgs

    Id string
    The alert definition ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    Not bool
    Whether or not to negate the alert definition. If true, flow checks for the negate condition of the respective alert.
    Id string
    The alert definition ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    Not bool
    Whether or not to negate the alert definition. If true, flow checks for the negate condition of the respective alert.
    id String
    The alert definition ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    not Boolean
    Whether or not to negate the alert definition. If true, flow checks for the negate condition of the respective alert.
    id string
    The alert definition ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    not boolean
    Whether or not to negate the alert definition. If true, flow checks for the negate condition of the respective alert.
    id str
    The alert definition ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    not_ bool
    Whether or not to negate the alert definition. If true, flow checks for the negate condition of the respective alert.
    id String
    The alert definition ID.

    • Constraints: The maximum length is 36 characters. The minimum length is 36 characters. The value must match regular expression /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.
    not Boolean
    Whether or not to negate the alert definition. If true, flow checks for the negate condition of the respective alert.

    LogsAlertDefinitionIncidentsSettings, LogsAlertDefinitionIncidentsSettingsArgs

    Minutes double
    The time in minutes before the alert can be triggered again.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    NotifyOn string
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    Minutes float64
    The time in minutes before the alert can be triggered again.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    NotifyOn string
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    minutes Double
    The time in minutes before the alert can be triggered again.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    notifyOn String
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    minutes number
    The time in minutes before the alert can be triggered again.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    notifyOn string
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    minutes float
    The time in minutes before the alert can be triggered again.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    notify_on str
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    minutes Number
    The time in minutes before the alert can be triggered again.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    notifyOn String
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.

    LogsAlertDefinitionLogsAnomaly, LogsAlertDefinitionLogsAnomalyArgs

    ConditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified.
    Rules List<LogsAlertDefinitionLogsAnomalyRule>
    The condition rules for the log anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    AnomalyAlertSettings LogsAlertDefinitionLogsAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    EvaluationDelayMs double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    LogsFilter LogsAlertDefinitionLogsAnomalyLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters List<string>
    The notification payload filter to specify which fields are included in the notification.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    ConditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified.
    Rules []LogsAlertDefinitionLogsAnomalyRule
    The condition rules for the log anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    AnomalyAlertSettings LogsAlertDefinitionLogsAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    EvaluationDelayMs float64
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    LogsFilter LogsAlertDefinitionLogsAnomalyLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters []string
    The notification payload filter to specify which fields are included in the notification.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    conditionType String
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified.
    rules List<LogsAlertDefinitionLogsAnomalyRule>
    The condition rules for the log anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    anomalyAlertSettings LogsAlertDefinitionLogsAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    evaluationDelayMs Double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    logsFilter LogsAlertDefinitionLogsAnomalyLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The notification payload filter to specify which fields are included in the notification.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    conditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified.
    rules LogsAlertDefinitionLogsAnomalyRule[]
    The condition rules for the log anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    anomalyAlertSettings LogsAlertDefinitionLogsAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    evaluationDelayMs number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    logsFilter LogsAlertDefinitionLogsAnomalyLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters string[]
    The notification payload filter to specify which fields are included in the notification.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    condition_type str
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified.
    rules Sequence[LogsAlertDefinitionLogsAnomalyRule]
    The condition rules for the log anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    anomaly_alert_settings LogsAlertDefinitionLogsAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    evaluation_delay_ms float
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    logs_filter LogsAlertDefinitionLogsAnomalyLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notification_payload_filters Sequence[str]
    The notification payload filter to specify which fields are included in the notification.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    conditionType String
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified.
    rules List<Property Map>
    The condition rules for the log anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    anomalyAlertSettings Property Map
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    evaluationDelayMs Number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    logsFilter Property Map
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The notification payload filter to specify which fields are included in the notification.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.

    LogsAlertDefinitionLogsAnomalyAnomalyAlertSettings, LogsAlertDefinitionLogsAnomalyAnomalyAlertSettingsArgs

    PercentageOfDeviation double
    The percentage of deviation from the baseline when the alert is triggered.
    PercentageOfDeviation float64
    The percentage of deviation from the baseline when the alert is triggered.
    percentageOfDeviation Double
    The percentage of deviation from the baseline when the alert is triggered.
    percentageOfDeviation number
    The percentage of deviation from the baseline when the alert is triggered.
    percentage_of_deviation float
    The percentage of deviation from the baseline when the alert is triggered.
    percentageOfDeviation Number
    The percentage of deviation from the baseline when the alert is triggered.

    LogsAlertDefinitionLogsAnomalyLogsFilter, LogsAlertDefinitionLogsAnomalyLogsFilterArgs

    SimpleFilter LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    SimpleFilter LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simple_filter LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter Property Map
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:

    LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilter, LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterArgs

    LabelFilters LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LabelFilters LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    label_filters LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    lucene_query str
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters Property Map
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFilters, LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersArgs

    ApplicationNames List<LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities List<string>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames List<LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    ApplicationNames []LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationName
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities []string
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames []LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemName
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationName[]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities string[]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemName[]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    application_names Sequence[LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationName]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities Sequence[str]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystem_names Sequence[LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemName]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<Property Map>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<Property Map>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:

    LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationName, LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersApplicationNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemName, LogsAlertDefinitionLogsAnomalyLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsAnomalyRule, LogsAlertDefinitionLogsAnomalyRuleArgs

    Condition LogsAlertDefinitionLogsAnomalyRuleCondition
    The condition for the anomaly alert. Nested schema for condition:
    Condition LogsAlertDefinitionLogsAnomalyRuleCondition
    The condition for the anomaly alert. Nested schema for condition:
    condition LogsAlertDefinitionLogsAnomalyRuleCondition
    The condition for the anomaly alert. Nested schema for condition:
    condition LogsAlertDefinitionLogsAnomalyRuleCondition
    The condition for the anomaly alert. Nested schema for condition:
    condition LogsAlertDefinitionLogsAnomalyRuleCondition
    The condition for the anomaly alert. Nested schema for condition:
    condition Property Map
    The condition for the anomaly alert. Nested schema for condition:

    LogsAlertDefinitionLogsAnomalyRuleCondition, LogsAlertDefinitionLogsAnomalyRuleConditionArgs

    MinimumThreshold double
    The threshold value for the alert condition.
    TimeWindow LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    MinimumThreshold float64
    The threshold value for the alert condition.
    TimeWindow LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    minimumThreshold Double
    The threshold value for the alert condition.
    timeWindow LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    minimumThreshold number
    The threshold value for the alert condition.
    timeWindow LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    minimum_threshold float
    The threshold value for the alert condition.
    time_window LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    minimumThreshold Number
    The threshold value for the alert condition.
    timeWindow Property Map
    The time window for the alert condition. Nested schema for time_window:

    LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindow, LogsAlertDefinitionLogsAnomalyRuleConditionTimeWindowArgs

    LogsTimeWindowSpecificValue string
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    LogsTimeWindowSpecificValue string
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsTimeWindowSpecificValue String
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsTimeWindowSpecificValue string
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logs_time_window_specific_value str
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsTimeWindowSpecificValue String
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.

    LogsAlertDefinitionLogsImmediate, LogsAlertDefinitionLogsImmediateArgs

    LogsFilter LogsAlertDefinitionLogsImmediateLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters List<string>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    LogsFilter LogsAlertDefinitionLogsImmediateLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters []string
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    logsFilter LogsAlertDefinitionLogsImmediateLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    logsFilter LogsAlertDefinitionLogsImmediateLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters string[]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    logs_filter LogsAlertDefinitionLogsImmediateLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notification_payload_filters Sequence[str]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    logsFilter Property Map
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.

    LogsAlertDefinitionLogsImmediateLogsFilter, LogsAlertDefinitionLogsImmediateLogsFilterArgs

    SimpleFilter LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    SimpleFilter LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simple_filter LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter Property Map
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:

    LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilter, LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterArgs

    LabelFilters LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LabelFilters LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    label_filters LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    lucene_query str
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters Property Map
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFilters, LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersArgs

    ApplicationNames List<LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities List<string>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames List<LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    ApplicationNames []LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationName
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities []string
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames []LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemName
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationName[]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities string[]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemName[]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    application_names Sequence[LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationName]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities Sequence[str]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystem_names Sequence[LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemName]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<Property Map>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<Property Map>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:

    LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationName, LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersApplicationNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemName, LogsAlertDefinitionLogsImmediateLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsNewValue, LogsAlertDefinitionLogsNewValueArgs

    Rules List<LogsAlertDefinitionLogsNewValueRule>
    The condition rules for the log new value alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    LogsFilter LogsAlertDefinitionLogsNewValueLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters List<string>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    Rules []LogsAlertDefinitionLogsNewValueRule
    The condition rules for the log new value alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    LogsFilter LogsAlertDefinitionLogsNewValueLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters []string
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    rules List<LogsAlertDefinitionLogsNewValueRule>
    The condition rules for the log new value alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    logsFilter LogsAlertDefinitionLogsNewValueLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    rules LogsAlertDefinitionLogsNewValueRule[]
    The condition rules for the log new value alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    logsFilter LogsAlertDefinitionLogsNewValueLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters string[]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    rules Sequence[LogsAlertDefinitionLogsNewValueRule]
    The condition rules for the log new value alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    logs_filter LogsAlertDefinitionLogsNewValueLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notification_payload_filters Sequence[str]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    rules List<Property Map>
    The condition rules for the log new value alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    logsFilter Property Map
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.

    LogsAlertDefinitionLogsNewValueLogsFilter, LogsAlertDefinitionLogsNewValueLogsFilterArgs

    SimpleFilter LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    SimpleFilter LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simple_filter LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter Property Map
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:

    LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilter, LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterArgs

    LabelFilters LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LabelFilters LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    label_filters LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    lucene_query str
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters Property Map
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFilters, LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersArgs

    ApplicationNames List<LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities List<string>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames List<LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    ApplicationNames []LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationName
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities []string
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames []LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemName
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationName[]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities string[]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemName[]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    application_names Sequence[LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationName]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities Sequence[str]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystem_names Sequence[LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemName]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<Property Map>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<Property Map>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:

    LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationName, LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersApplicationNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemName, LogsAlertDefinitionLogsNewValueLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsNewValueRule, LogsAlertDefinitionLogsNewValueRuleArgs

    Condition LogsAlertDefinitionLogsNewValueRuleCondition
    The condition for detecting new values in logs. Nested schema for condition:
    Condition LogsAlertDefinitionLogsNewValueRuleCondition
    The condition for detecting new values in logs. Nested schema for condition:
    condition LogsAlertDefinitionLogsNewValueRuleCondition
    The condition for detecting new values in logs. Nested schema for condition:
    condition LogsAlertDefinitionLogsNewValueRuleCondition
    The condition for detecting new values in logs. Nested schema for condition:
    condition LogsAlertDefinitionLogsNewValueRuleCondition
    The condition for detecting new values in logs. Nested schema for condition:
    condition Property Map
    The condition for detecting new values in logs. Nested schema for condition:

    LogsAlertDefinitionLogsNewValueRuleCondition, LogsAlertDefinitionLogsNewValueRuleConditionArgs

    KeypathToTrack string
    The keypath to track for new values.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    TimeWindow LogsAlertDefinitionLogsNewValueRuleConditionTimeWindow
    The time window for detecting new values. Nested schema for time_window:
    KeypathToTrack string
    The keypath to track for new values.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    TimeWindow LogsAlertDefinitionLogsNewValueRuleConditionTimeWindow
    The time window for detecting new values. Nested schema for time_window:
    keypathToTrack String
    The keypath to track for new values.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    timeWindow LogsAlertDefinitionLogsNewValueRuleConditionTimeWindow
    The time window for detecting new values. Nested schema for time_window:
    keypathToTrack string
    The keypath to track for new values.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    timeWindow LogsAlertDefinitionLogsNewValueRuleConditionTimeWindow
    The time window for detecting new values. Nested schema for time_window:
    keypath_to_track str
    The keypath to track for new values.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    time_window LogsAlertDefinitionLogsNewValueRuleConditionTimeWindow
    The time window for detecting new values. Nested schema for time_window:
    keypathToTrack String
    The keypath to track for new values.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    timeWindow Property Map
    The time window for detecting new values. Nested schema for time_window:

    LogsAlertDefinitionLogsNewValueRuleConditionTimeWindow, LogsAlertDefinitionLogsNewValueRuleConditionTimeWindowArgs

    LogsNewValueTimeWindowSpecificValue string
    A time window defined by a specific value.

    • Constraints: Allowable values are: hours_12_or_unspecified, hours_24, hours_48, hours_72, week_1, month_1, months_2, months_3.
    LogsNewValueTimeWindowSpecificValue string
    A time window defined by a specific value.

    • Constraints: Allowable values are: hours_12_or_unspecified, hours_24, hours_48, hours_72, week_1, month_1, months_2, months_3.
    logsNewValueTimeWindowSpecificValue String
    A time window defined by a specific value.

    • Constraints: Allowable values are: hours_12_or_unspecified, hours_24, hours_48, hours_72, week_1, month_1, months_2, months_3.
    logsNewValueTimeWindowSpecificValue string
    A time window defined by a specific value.

    • Constraints: Allowable values are: hours_12_or_unspecified, hours_24, hours_48, hours_72, week_1, month_1, months_2, months_3.
    logs_new_value_time_window_specific_value str
    A time window defined by a specific value.

    • Constraints: Allowable values are: hours_12_or_unspecified, hours_24, hours_48, hours_72, week_1, month_1, months_2, months_3.
    logsNewValueTimeWindowSpecificValue String
    A time window defined by a specific value.

    • Constraints: Allowable values are: hours_12_or_unspecified, hours_24, hours_48, hours_72, week_1, month_1, months_2, months_3.

    LogsAlertDefinitionLogsRatioThreshold, LogsAlertDefinitionLogsRatioThresholdArgs

    ConditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    Denominator LogsAlertDefinitionLogsRatioThresholdDenominator
    The filter to match log entries for immediate alerts. Nested schema for denominator:
    GroupByFor string
    The group by settings for the numerator and denominator filters.

    • Constraints: Allowable values are: both_or_unspecified, numerator_only, denumerator_only.
    Numerator LogsAlertDefinitionLogsRatioThresholdNumerator
    The filter to match log entries for immediate alerts. Nested schema for numerator:
    Rules List<LogsAlertDefinitionLogsRatioThresholdRule>
    The condition rules for the ratio alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    DenominatorAlias string
    The alias for the denominator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    EvaluationDelayMs double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    IgnoreInfinity bool
    Determine whether to ignore an infinity result or not. If true, alert is not triggered. When the value of second query is 0, the result of the ratio will be infinity.
    NotificationPayloadFilters List<string>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    NumeratorAlias string
    The alias for the numerator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    UndetectedValuesManagement LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    ConditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    Denominator LogsAlertDefinitionLogsRatioThresholdDenominator
    The filter to match log entries for immediate alerts. Nested schema for denominator:
    GroupByFor string
    The group by settings for the numerator and denominator filters.

    • Constraints: Allowable values are: both_or_unspecified, numerator_only, denumerator_only.
    Numerator LogsAlertDefinitionLogsRatioThresholdNumerator
    The filter to match log entries for immediate alerts. Nested schema for numerator:
    Rules []LogsAlertDefinitionLogsRatioThresholdRule
    The condition rules for the ratio alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    DenominatorAlias string
    The alias for the denominator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    EvaluationDelayMs float64
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    IgnoreInfinity bool
    Determine whether to ignore an infinity result or not. If true, alert is not triggered. When the value of second query is 0, the result of the ratio will be infinity.
    NotificationPayloadFilters []string
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    NumeratorAlias string
    The alias for the numerator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    UndetectedValuesManagement LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType String
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    denominator LogsAlertDefinitionLogsRatioThresholdDenominator
    The filter to match log entries for immediate alerts. Nested schema for denominator:
    groupByFor String
    The group by settings for the numerator and denominator filters.

    • Constraints: Allowable values are: both_or_unspecified, numerator_only, denumerator_only.
    numerator LogsAlertDefinitionLogsRatioThresholdNumerator
    The filter to match log entries for immediate alerts. Nested schema for numerator:
    rules List<LogsAlertDefinitionLogsRatioThresholdRule>
    The condition rules for the ratio alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    denominatorAlias String
    The alias for the denominator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    evaluationDelayMs Double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ignoreInfinity Boolean
    Determine whether to ignore an infinity result or not. If true, alert is not triggered. When the value of second query is 0, the result of the ratio will be infinity.
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    numeratorAlias String
    The alias for the numerator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    undetectedValuesManagement LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    denominator LogsAlertDefinitionLogsRatioThresholdDenominator
    The filter to match log entries for immediate alerts. Nested schema for denominator:
    groupByFor string
    The group by settings for the numerator and denominator filters.

    • Constraints: Allowable values are: both_or_unspecified, numerator_only, denumerator_only.
    numerator LogsAlertDefinitionLogsRatioThresholdNumerator
    The filter to match log entries for immediate alerts. Nested schema for numerator:
    rules LogsAlertDefinitionLogsRatioThresholdRule[]
    The condition rules for the ratio alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    denominatorAlias string
    The alias for the denominator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    evaluationDelayMs number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ignoreInfinity boolean
    Determine whether to ignore an infinity result or not. If true, alert is not triggered. When the value of second query is 0, the result of the ratio will be infinity.
    notificationPayloadFilters string[]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    numeratorAlias string
    The alias for the numerator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    undetectedValuesManagement LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    condition_type str
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    denominator LogsAlertDefinitionLogsRatioThresholdDenominator
    The filter to match log entries for immediate alerts. Nested schema for denominator:
    group_by_for str
    The group by settings for the numerator and denominator filters.

    • Constraints: Allowable values are: both_or_unspecified, numerator_only, denumerator_only.
    numerator LogsAlertDefinitionLogsRatioThresholdNumerator
    The filter to match log entries for immediate alerts. Nested schema for numerator:
    rules Sequence[LogsAlertDefinitionLogsRatioThresholdRule]
    The condition rules for the ratio alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    denominator_alias str
    The alias for the denominator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    evaluation_delay_ms float
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ignore_infinity bool
    Determine whether to ignore an infinity result or not. If true, alert is not triggered. When the value of second query is 0, the result of the ratio will be infinity.
    notification_payload_filters Sequence[str]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    numerator_alias str
    The alias for the numerator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    undetected_values_management LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType String
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    denominator Property Map
    The filter to match log entries for immediate alerts. Nested schema for denominator:
    groupByFor String
    The group by settings for the numerator and denominator filters.

    • Constraints: Allowable values are: both_or_unspecified, numerator_only, denumerator_only.
    numerator Property Map
    The filter to match log entries for immediate alerts. Nested schema for numerator:
    rules List<Property Map>
    The condition rules for the ratio alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    denominatorAlias String
    The alias for the denominator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    evaluationDelayMs Number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ignoreInfinity Boolean
    Determine whether to ignore an infinity result or not. If true, alert is not triggered. When the value of second query is 0, the result of the ratio will be infinity.
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    numeratorAlias String
    The alias for the numerator filter, used for display purposes.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    undetectedValuesManagement Property Map
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:

    LogsAlertDefinitionLogsRatioThresholdDenominator, LogsAlertDefinitionLogsRatioThresholdDenominatorArgs

    SimpleFilter LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    SimpleFilter LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simple_filter LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter Property Map
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:

    LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilter, LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterArgs

    LabelFilters LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LabelFilters LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    label_filters LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    lucene_query str
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters Property Map
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFilters, LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersArgs

    ApplicationNames List<LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities List<string>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames List<LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    ApplicationNames []LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationName
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities []string
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames []LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemName
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationName[]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities string[]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemName[]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    application_names Sequence[LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationName]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities Sequence[str]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystem_names Sequence[LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemName]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<Property Map>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<Property Map>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:

    LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationName, LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersApplicationNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemName, LogsAlertDefinitionLogsRatioThresholdDenominatorSimpleFilterLabelFiltersSubsystemNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsRatioThresholdNumerator, LogsAlertDefinitionLogsRatioThresholdNumeratorArgs

    SimpleFilter LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    SimpleFilter LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simple_filter LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter Property Map
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:

    LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilter, LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterArgs

    LabelFilters LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LabelFilters LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    label_filters LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    lucene_query str
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters Property Map
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFilters, LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersArgs

    ApplicationNames List<LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities List<string>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames List<LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    ApplicationNames []LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationName
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities []string
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames []LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemName
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationName[]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities string[]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemName[]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    application_names Sequence[LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationName]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities Sequence[str]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystem_names Sequence[LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemName]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<Property Map>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<Property Map>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:

    LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationName, LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersApplicationNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemName, LogsAlertDefinitionLogsRatioThresholdNumeratorSimpleFilterLabelFiltersSubsystemNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsRatioThresholdRule, LogsAlertDefinitionLogsRatioThresholdRuleArgs

    Condition LogsAlertDefinitionLogsRatioThresholdRuleCondition
    The condition for the ratio alert. Nested schema for condition:
    Override LogsAlertDefinitionLogsRatioThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    Condition LogsAlertDefinitionLogsRatioThresholdRuleCondition
    The condition for the ratio alert. Nested schema for condition:
    Override LogsAlertDefinitionLogsRatioThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsRatioThresholdRuleCondition
    The condition for the ratio alert. Nested schema for condition:
    override LogsAlertDefinitionLogsRatioThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsRatioThresholdRuleCondition
    The condition for the ratio alert. Nested schema for condition:
    override LogsAlertDefinitionLogsRatioThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsRatioThresholdRuleCondition
    The condition for the ratio alert. Nested schema for condition:
    override LogsAlertDefinitionLogsRatioThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition Property Map
    The condition for the ratio alert. Nested schema for condition:
    override Property Map
    The override settings for the alert. Nested schema for override:

    LogsAlertDefinitionLogsRatioThresholdRuleCondition, LogsAlertDefinitionLogsRatioThresholdRuleConditionArgs

    Threshold double
    The threshold value for the alert condition.
    TimeWindow LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    Threshold float64
    The threshold value for the alert condition.
    TimeWindow LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    threshold Double
    The threshold value for the alert condition.
    timeWindow LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    threshold number
    The threshold value for the alert condition.
    timeWindow LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    threshold float
    The threshold value for the alert condition.
    time_window LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    threshold Number
    The threshold value for the alert condition.
    timeWindow Property Map
    The time window for the alert condition. Nested schema for time_window:

    LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindow, LogsAlertDefinitionLogsRatioThresholdRuleConditionTimeWindowArgs

    LogsRatioTimeWindowSpecificValue string
    Specifies the time window for the ratio alert.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    LogsRatioTimeWindowSpecificValue string
    Specifies the time window for the ratio alert.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsRatioTimeWindowSpecificValue String
    Specifies the time window for the ratio alert.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsRatioTimeWindowSpecificValue string
    Specifies the time window for the ratio alert.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logs_ratio_time_window_specific_value str
    Specifies the time window for the ratio alert.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsRatioTimeWindowSpecificValue String
    Specifies the time window for the ratio alert.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.

    LogsAlertDefinitionLogsRatioThresholdRuleOverride, LogsAlertDefinitionLogsRatioThresholdRuleOverrideArgs

    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority str
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.

    LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagement, LogsAlertDefinitionLogsRatioThresholdUndetectedValuesManagementArgs

    AutoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    TriggerUndetectedValues bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    AutoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    TriggerUndetectedValues bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe String
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues Boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    auto_retire_timeframe str
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    trigger_undetected_values bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe String
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues Boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.

    LogsAlertDefinitionLogsThreshold, LogsAlertDefinitionLogsThresholdArgs

    ConditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    Rules List<LogsAlertDefinitionLogsThresholdRule>
    The condition rules for the threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    EvaluationDelayMs double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    LogsFilter LogsAlertDefinitionLogsThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters List<string>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    UndetectedValuesManagement LogsAlertDefinitionLogsThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    ConditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    Rules []LogsAlertDefinitionLogsThresholdRule
    The condition rules for the threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    EvaluationDelayMs float64
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    LogsFilter LogsAlertDefinitionLogsThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters []string
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    UndetectedValuesManagement LogsAlertDefinitionLogsThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType String
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    rules List<LogsAlertDefinitionLogsThresholdRule>
    The condition rules for the threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs Double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    logsFilter LogsAlertDefinitionLogsThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    undetectedValuesManagement LogsAlertDefinitionLogsThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    rules LogsAlertDefinitionLogsThresholdRule[]
    The condition rules for the threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    logsFilter LogsAlertDefinitionLogsThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters string[]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    undetectedValuesManagement LogsAlertDefinitionLogsThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    condition_type str
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    rules Sequence[LogsAlertDefinitionLogsThresholdRule]
    The condition rules for the threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluation_delay_ms float
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    logs_filter LogsAlertDefinitionLogsThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notification_payload_filters Sequence[str]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    undetected_values_management LogsAlertDefinitionLogsThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType String
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    rules List<Property Map>
    The condition rules for the threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs Number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    logsFilter Property Map
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    undetectedValuesManagement Property Map
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:

    LogsAlertDefinitionLogsThresholdLogsFilter, LogsAlertDefinitionLogsThresholdLogsFilterArgs

    SimpleFilter LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    SimpleFilter LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simple_filter LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter Property Map
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:

    LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilter, LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterArgs

    LabelFilters LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LabelFilters LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    label_filters LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    lucene_query str
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters Property Map
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFilters, LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersArgs

    ApplicationNames List<LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities List<string>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames List<LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    ApplicationNames []LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationName
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities []string
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames []LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationName[]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities string[]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName[]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    application_names Sequence[LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationName]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities Sequence[str]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystem_names Sequence[LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<Property Map>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<Property Map>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:

    LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationName, LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName, LogsAlertDefinitionLogsThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsThresholdRule, LogsAlertDefinitionLogsThresholdRuleArgs

    Condition LogsAlertDefinitionLogsThresholdRuleCondition
    The condition for the threshold alert. Nested schema for condition:
    Override LogsAlertDefinitionLogsThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    Condition LogsAlertDefinitionLogsThresholdRuleCondition
    The condition for the threshold alert. Nested schema for condition:
    Override LogsAlertDefinitionLogsThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsThresholdRuleCondition
    The condition for the threshold alert. Nested schema for condition:
    override LogsAlertDefinitionLogsThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsThresholdRuleCondition
    The condition for the threshold alert. Nested schema for condition:
    override LogsAlertDefinitionLogsThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsThresholdRuleCondition
    The condition for the threshold alert. Nested schema for condition:
    override LogsAlertDefinitionLogsThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition Property Map
    The condition for the threshold alert. Nested schema for condition:
    override Property Map
    The override settings for the alert. Nested schema for override:

    LogsAlertDefinitionLogsThresholdRuleCondition, LogsAlertDefinitionLogsThresholdRuleConditionArgs

    Threshold double
    The threshold value for the alert condition.
    TimeWindow LogsAlertDefinitionLogsThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    Threshold float64
    The threshold value for the alert condition.
    TimeWindow LogsAlertDefinitionLogsThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    threshold Double
    The threshold value for the alert condition.
    timeWindow LogsAlertDefinitionLogsThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    threshold number
    The threshold value for the alert condition.
    timeWindow LogsAlertDefinitionLogsThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    threshold float
    The threshold value for the alert condition.
    time_window LogsAlertDefinitionLogsThresholdRuleConditionTimeWindow
    The time window for the alert condition. Nested schema for time_window:
    threshold Number
    The threshold value for the alert condition.
    timeWindow Property Map
    The time window for the alert condition. Nested schema for time_window:

    LogsAlertDefinitionLogsThresholdRuleConditionTimeWindow, LogsAlertDefinitionLogsThresholdRuleConditionTimeWindowArgs

    LogsTimeWindowSpecificValue string
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    LogsTimeWindowSpecificValue string
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsTimeWindowSpecificValue String
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsTimeWindowSpecificValue string
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logs_time_window_specific_value str
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.
    logsTimeWindowSpecificValue String
    The time window defined for an alert to be triggered.

    • Constraints: Allowable values are: minutes_5_or_unspecified, minutes_10, minutes_20, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, hours_36.

    LogsAlertDefinitionLogsThresholdRuleOverride, LogsAlertDefinitionLogsThresholdRuleOverrideArgs

    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority str
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.

    LogsAlertDefinitionLogsThresholdUndetectedValuesManagement, LogsAlertDefinitionLogsThresholdUndetectedValuesManagementArgs

    AutoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    TriggerUndetectedValues bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    AutoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    TriggerUndetectedValues bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe String
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues Boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    auto_retire_timeframe str
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    trigger_undetected_values bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe String
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues Boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.

    LogsAlertDefinitionLogsTimeRelativeThreshold, LogsAlertDefinitionLogsTimeRelativeThresholdArgs

    ConditionType string
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    Rules List<LogsAlertDefinitionLogsTimeRelativeThresholdRule>
    The condition rules for the time-relative alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    EvaluationDelayMs double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    IgnoreInfinity bool
    Ignore infinity values in the alert.
    LogsFilter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters List<string>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    UndetectedValuesManagement LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    ConditionType string
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    Rules []LogsAlertDefinitionLogsTimeRelativeThresholdRule
    The condition rules for the time-relative alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    EvaluationDelayMs float64
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    IgnoreInfinity bool
    Ignore infinity values in the alert.
    LogsFilter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    NotificationPayloadFilters []string
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    UndetectedValuesManagement LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType String
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    rules List<LogsAlertDefinitionLogsTimeRelativeThresholdRule>
    The condition rules for the time-relative alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs Double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ignoreInfinity Boolean
    Ignore infinity values in the alert.
    logsFilter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    undetectedValuesManagement LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType string
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    rules LogsAlertDefinitionLogsTimeRelativeThresholdRule[]
    The condition rules for the time-relative alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ignoreInfinity boolean
    Ignore infinity values in the alert.
    logsFilter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters string[]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    undetectedValuesManagement LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    condition_type str
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    rules Sequence[LogsAlertDefinitionLogsTimeRelativeThresholdRule]
    The condition rules for the time-relative alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluation_delay_ms float
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ignore_infinity bool
    Ignore infinity values in the alert.
    logs_filter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notification_payload_filters Sequence[str]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    undetected_values_management LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType String
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than.
    rules List<Property Map>
    The condition rules for the time-relative alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs Number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ignoreInfinity Boolean
    Ignore infinity values in the alert.
    logsFilter Property Map
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    undetectedValuesManagement Property Map
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:

    LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilter, LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterArgs

    SimpleFilter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    SimpleFilter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simple_filter LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter Property Map
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:

    LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilter, LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterArgs

    LabelFilters LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LabelFilters LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    label_filters LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    lucene_query str
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters Property Map
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFilters, LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersArgs

    ApplicationNames List<LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities List<string>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames List<LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    ApplicationNames []LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationName
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities []string
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames []LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationName[]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities string[]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName[]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    application_names Sequence[LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationName]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities Sequence[str]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystem_names Sequence[LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<Property Map>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<Property Map>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:

    LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationName, LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersApplicationNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemName, LogsAlertDefinitionLogsTimeRelativeThresholdLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsTimeRelativeThresholdRule, LogsAlertDefinitionLogsTimeRelativeThresholdRuleArgs

    Condition LogsAlertDefinitionLogsTimeRelativeThresholdRuleCondition
    The condition for the time-relative alert. Nested schema for condition:
    Override LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    Condition LogsAlertDefinitionLogsTimeRelativeThresholdRuleCondition
    The condition for the time-relative alert. Nested schema for condition:
    Override LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsTimeRelativeThresholdRuleCondition
    The condition for the time-relative alert. Nested schema for condition:
    override LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsTimeRelativeThresholdRuleCondition
    The condition for the time-relative alert. Nested schema for condition:
    override LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionLogsTimeRelativeThresholdRuleCondition
    The condition for the time-relative alert. Nested schema for condition:
    override LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition Property Map
    The condition for the time-relative alert. Nested schema for condition:
    override Property Map
    The override settings for the alert. Nested schema for override:

    LogsAlertDefinitionLogsTimeRelativeThresholdRuleCondition, LogsAlertDefinitionLogsTimeRelativeThresholdRuleConditionArgs

    ComparedTo string
    The time frame to compare the current value against.

    • Constraints: Allowable values are: previous_hour_or_unspecified, same_hour_yesterday, same_hour_last_week, yesterday, same_day_last_week, same_day_last_month.
    Threshold double
    The threshold value for the alert condition.
    ComparedTo string
    The time frame to compare the current value against.

    • Constraints: Allowable values are: previous_hour_or_unspecified, same_hour_yesterday, same_hour_last_week, yesterday, same_day_last_week, same_day_last_month.
    Threshold float64
    The threshold value for the alert condition.
    comparedTo String
    The time frame to compare the current value against.

    • Constraints: Allowable values are: previous_hour_or_unspecified, same_hour_yesterday, same_hour_last_week, yesterday, same_day_last_week, same_day_last_month.
    threshold Double
    The threshold value for the alert condition.
    comparedTo string
    The time frame to compare the current value against.

    • Constraints: Allowable values are: previous_hour_or_unspecified, same_hour_yesterday, same_hour_last_week, yesterday, same_day_last_week, same_day_last_month.
    threshold number
    The threshold value for the alert condition.
    compared_to str
    The time frame to compare the current value against.

    • Constraints: Allowable values are: previous_hour_or_unspecified, same_hour_yesterday, same_hour_last_week, yesterday, same_day_last_week, same_day_last_month.
    threshold float
    The threshold value for the alert condition.
    comparedTo String
    The time frame to compare the current value against.

    • Constraints: Allowable values are: previous_hour_or_unspecified, same_hour_yesterday, same_hour_last_week, yesterday, same_day_last_week, same_day_last_month.
    threshold Number
    The threshold value for the alert condition.

    LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverride, LogsAlertDefinitionLogsTimeRelativeThresholdRuleOverrideArgs

    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority str
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.

    LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagement, LogsAlertDefinitionLogsTimeRelativeThresholdUndetectedValuesManagementArgs

    AutoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    TriggerUndetectedValues bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    AutoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    TriggerUndetectedValues bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe String
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues Boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    auto_retire_timeframe str
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    trigger_undetected_values bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe String
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues Boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.

    LogsAlertDefinitionLogsUniqueCount, LogsAlertDefinitionLogsUniqueCountArgs

    Rules List<LogsAlertDefinitionLogsUniqueCountRule>
    Rules defining the conditions for the unique count alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    UniqueCountKeypath string
    The keypath in the logs to be used for unique count.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LogsFilter LogsAlertDefinitionLogsUniqueCountLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    MaxUniqueCountPerGroupByKey string
    The maximum unique count per group by key.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    NotificationPayloadFilters List<string>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    Rules []LogsAlertDefinitionLogsUniqueCountRule
    Rules defining the conditions for the unique count alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    UniqueCountKeypath string
    The keypath in the logs to be used for unique count.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LogsFilter LogsAlertDefinitionLogsUniqueCountLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    MaxUniqueCountPerGroupByKey string
    The maximum unique count per group by key.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    NotificationPayloadFilters []string
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    rules List<LogsAlertDefinitionLogsUniqueCountRule>
    Rules defining the conditions for the unique count alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    uniqueCountKeypath String
    The keypath in the logs to be used for unique count.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    logsFilter LogsAlertDefinitionLogsUniqueCountLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    maxUniqueCountPerGroupByKey String
    The maximum unique count per group by key.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    rules LogsAlertDefinitionLogsUniqueCountRule[]
    Rules defining the conditions for the unique count alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    uniqueCountKeypath string
    The keypath in the logs to be used for unique count.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    logsFilter LogsAlertDefinitionLogsUniqueCountLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    maxUniqueCountPerGroupByKey string
    The maximum unique count per group by key.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    notificationPayloadFilters string[]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    rules Sequence[LogsAlertDefinitionLogsUniqueCountRule]
    Rules defining the conditions for the unique count alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    unique_count_keypath str
    The keypath in the logs to be used for unique count.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    logs_filter LogsAlertDefinitionLogsUniqueCountLogsFilter
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    max_unique_count_per_group_by_key str
    The maximum unique count per group by key.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    notification_payload_filters Sequence[str]
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    rules List<Property Map>
    Rules defining the conditions for the unique count alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    uniqueCountKeypath String
    The keypath in the logs to be used for unique count.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    logsFilter Property Map
    The filter to match log entries for immediate alerts. Nested schema for logs_filter:
    maxUniqueCountPerGroupByKey String
    The maximum unique count per group by key.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    notificationPayloadFilters List<String>
    The filter to specify which fields are included in the notification payload.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.

    LogsAlertDefinitionLogsUniqueCountLogsFilter, LogsAlertDefinitionLogsUniqueCountLogsFilterArgs

    SimpleFilter LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    SimpleFilter LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simple_filter LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilter
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:
    simpleFilter Property Map
    A simple filter that uses a Lucene query and label filters. Nested schema for simple_filter:

    LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilter, LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterArgs

    LabelFilters LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    LabelFilters LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    LuceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery string
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    label_filters LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFilters
    The label filters to filter logs. Nested schema for label_filters:
    lucene_query str
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    labelFilters Property Map
    The label filters to filter logs. Nested schema for label_filters:
    luceneQuery String
    The Lucene query to filter logs.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFilters, LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersArgs

    ApplicationNames List<LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities List<string>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames List<LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    ApplicationNames []LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationName
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    Severities []string
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    SubsystemNames []LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemName
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationName>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemName>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationName[]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities string[]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemName[]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    application_names Sequence[LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationName]
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities Sequence[str]
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystem_names Sequence[LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemName]
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:
    applicationNames List<Property Map>
    Filter by application names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for application_name:
    severities List<String>
    Filter by log severities.

    • Constraints: Allowable list items are: verbose_unspecified, debug, info, warning, error, critical. The maximum length is 4096 items. The minimum length is 0 items.
    subsystemNames List<Property Map>
    Filter by subsystem names.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for subsystem_name:

    LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationName, LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersApplicationNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemName, LogsAlertDefinitionLogsUniqueCountLogsFilterSimpleFilterLabelFiltersSubsystemNameArgs

    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    Operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    Value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation string
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value string
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation str
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value str
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.
    operation String
    The operation to perform on the label value.

    • Constraints: Allowable values are: is_or_unspecified, includes, ends_with, starts_with.
    value String
    The value used to filter the label.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^.*$/.

    LogsAlertDefinitionLogsUniqueCountRule, LogsAlertDefinitionLogsUniqueCountRuleArgs

    Condition LogsAlertDefinitionLogsUniqueCountRuleCondition
    The condition for detecting unique counts in logs. Nested schema for condition:
    Condition LogsAlertDefinitionLogsUniqueCountRuleCondition
    The condition for detecting unique counts in logs. Nested schema for condition:
    condition LogsAlertDefinitionLogsUniqueCountRuleCondition
    The condition for detecting unique counts in logs. Nested schema for condition:
    condition LogsAlertDefinitionLogsUniqueCountRuleCondition
    The condition for detecting unique counts in logs. Nested schema for condition:
    condition LogsAlertDefinitionLogsUniqueCountRuleCondition
    The condition for detecting unique counts in logs. Nested schema for condition:
    condition Property Map
    The condition for detecting unique counts in logs. Nested schema for condition:

    LogsAlertDefinitionLogsUniqueCountRuleCondition, LogsAlertDefinitionLogsUniqueCountRuleConditionArgs

    MaxUniqueCount string
    The maximum unique count for the alert condition.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    TimeWindow LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindow
    The time window for the unique count alert. Nested schema for time_window:
    MaxUniqueCount string
    The maximum unique count for the alert condition.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    TimeWindow LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindow
    The time window for the unique count alert. Nested schema for time_window:
    maxUniqueCount String
    The maximum unique count for the alert condition.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    timeWindow LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindow
    The time window for the unique count alert. Nested schema for time_window:
    maxUniqueCount string
    The maximum unique count for the alert condition.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    timeWindow LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindow
    The time window for the unique count alert. Nested schema for time_window:
    max_unique_count str
    The maximum unique count for the alert condition.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    time_window LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindow
    The time window for the unique count alert. Nested schema for time_window:
    maxUniqueCount String
    The maximum unique count for the alert condition.

    • Constraints: The maximum length is 19 characters. The minimum length is 1 character. The value must match regular expression /^-?\\d{1,19}$/.
    timeWindow Property Map
    The time window for the unique count alert. Nested schema for time_window:

    LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindow, LogsAlertDefinitionLogsUniqueCountRuleConditionTimeWindowArgs

    LogsUniqueValueTimeWindowSpecificValue string
    A time window defined by a specific value.

    • Constraints: Allowable values are: minute_1_or_unspecified, minutes_15, minutes_20, minutes_30, hours_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_5, minutes_10, hours_36.
    LogsUniqueValueTimeWindowSpecificValue string
    A time window defined by a specific value.

    • Constraints: Allowable values are: minute_1_or_unspecified, minutes_15, minutes_20, minutes_30, hours_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_5, minutes_10, hours_36.
    logsUniqueValueTimeWindowSpecificValue String
    A time window defined by a specific value.

    • Constraints: Allowable values are: minute_1_or_unspecified, minutes_15, minutes_20, minutes_30, hours_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_5, minutes_10, hours_36.
    logsUniqueValueTimeWindowSpecificValue string
    A time window defined by a specific value.

    • Constraints: Allowable values are: minute_1_or_unspecified, minutes_15, minutes_20, minutes_30, hours_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_5, minutes_10, hours_36.
    logs_unique_value_time_window_specific_value str
    A time window defined by a specific value.

    • Constraints: Allowable values are: minute_1_or_unspecified, minutes_15, minutes_20, minutes_30, hours_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_5, minutes_10, hours_36.
    logsUniqueValueTimeWindowSpecificValue String
    A time window defined by a specific value.

    • Constraints: Allowable values are: minute_1_or_unspecified, minutes_15, minutes_20, minutes_30, hours_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_5, minutes_10, hours_36.

    LogsAlertDefinitionMetricAnomaly, LogsAlertDefinitionMetricAnomalyArgs

    ConditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified, less_than_usual.
    MetricFilter LogsAlertDefinitionMetricAnomalyMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    Rules List<LogsAlertDefinitionMetricAnomalyRule>
    The condition rules for the metric anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    AnomalyAlertSettings LogsAlertDefinitionMetricAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    EvaluationDelayMs double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    ConditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified, less_than_usual.
    MetricFilter LogsAlertDefinitionMetricAnomalyMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    Rules []LogsAlertDefinitionMetricAnomalyRule
    The condition rules for the metric anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    AnomalyAlertSettings LogsAlertDefinitionMetricAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    EvaluationDelayMs float64
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    conditionType String
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified, less_than_usual.
    metricFilter LogsAlertDefinitionMetricAnomalyMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    rules List<LogsAlertDefinitionMetricAnomalyRule>
    The condition rules for the metric anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    anomalyAlertSettings LogsAlertDefinitionMetricAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    evaluationDelayMs Double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    conditionType string
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified, less_than_usual.
    metricFilter LogsAlertDefinitionMetricAnomalyMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    rules LogsAlertDefinitionMetricAnomalyRule[]
    The condition rules for the metric anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    anomalyAlertSettings LogsAlertDefinitionMetricAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    evaluationDelayMs number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    condition_type str
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified, less_than_usual.
    metric_filter LogsAlertDefinitionMetricAnomalyMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    rules Sequence[LogsAlertDefinitionMetricAnomalyRule]
    The condition rules for the metric anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    anomaly_alert_settings LogsAlertDefinitionMetricAnomalyAnomalyAlertSettings
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    evaluation_delay_ms float
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    conditionType String
    The condition type for the alert.

    • Constraints: Allowable values are: more_than_usual_or_unspecified, less_than_usual.
    metricFilter Property Map
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    rules List<Property Map>
    The condition rules for the metric anomaly alert.

    • Constraints: The maximum length is 1 item. The minimum length is 1 item. Nested schema for rules:
    anomalyAlertSettings Property Map
    The anomaly alert settings configuration. Nested schema for anomaly_alert_settings:
    evaluationDelayMs Number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.

    LogsAlertDefinitionMetricAnomalyAnomalyAlertSettings, LogsAlertDefinitionMetricAnomalyAnomalyAlertSettingsArgs

    PercentageOfDeviation double
    The percentage of deviation from the baseline when the alert is triggered.
    PercentageOfDeviation float64
    The percentage of deviation from the baseline when the alert is triggered.
    percentageOfDeviation Double
    The percentage of deviation from the baseline when the alert is triggered.
    percentageOfDeviation number
    The percentage of deviation from the baseline when the alert is triggered.
    percentage_of_deviation float
    The percentage of deviation from the baseline when the alert is triggered.
    percentageOfDeviation Number
    The percentage of deviation from the baseline when the alert is triggered.

    LogsAlertDefinitionMetricAnomalyMetricFilter, LogsAlertDefinitionMetricAnomalyMetricFilterArgs

    Promql string
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    Promql string
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    promql String
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    promql string
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    promql str
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    promql String
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionMetricAnomalyRule, LogsAlertDefinitionMetricAnomalyRuleArgs

    Condition LogsAlertDefinitionMetricAnomalyRuleCondition
    The condition for the metric anomaly alert. Nested schema for condition:
    Condition LogsAlertDefinitionMetricAnomalyRuleCondition
    The condition for the metric anomaly alert. Nested schema for condition:
    condition LogsAlertDefinitionMetricAnomalyRuleCondition
    The condition for the metric anomaly alert. Nested schema for condition:
    condition LogsAlertDefinitionMetricAnomalyRuleCondition
    The condition for the metric anomaly alert. Nested schema for condition:
    condition LogsAlertDefinitionMetricAnomalyRuleCondition
    The condition for the metric anomaly alert. Nested schema for condition:
    condition Property Map
    The condition for the metric anomaly alert. Nested schema for condition:

    LogsAlertDefinitionMetricAnomalyRuleCondition, LogsAlertDefinitionMetricAnomalyRuleConditionArgs

    MinNonNullValuesPct double
    The percentage of non-null values required to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    OfTheLast LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    Threshold double
    The threshold value for the alert condition.
    ForOverPct double
    The percentage of the metric values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    MinNonNullValuesPct float64
    The percentage of non-null values required to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    OfTheLast LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    Threshold float64
    The threshold value for the alert condition.
    ForOverPct float64
    The percentage of the metric values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    minNonNullValuesPct Double
    The percentage of non-null values required to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    ofTheLast LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    threshold Double
    The threshold value for the alert condition.
    forOverPct Double
    The percentage of the metric values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    minNonNullValuesPct number
    The percentage of non-null values required to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    ofTheLast LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    threshold number
    The threshold value for the alert condition.
    forOverPct number
    The percentage of the metric values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    min_non_null_values_pct float
    The percentage of non-null values required to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    of_the_last LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    threshold float
    The threshold value for the alert condition.
    for_over_pct float
    The percentage of the metric values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    minNonNullValuesPct Number
    The percentage of non-null values required to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    ofTheLast Property Map
    The time window for the alert condition. Nested schema for of_the_last:
    threshold Number
    The threshold value for the alert condition.
    forOverPct Number
    The percentage of the metric values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.

    LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLast, LogsAlertDefinitionMetricAnomalyRuleConditionOfTheLastArgs

    MetricTimeWindowDynamicDuration string
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    MetricTimeWindowSpecificValue string
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    MetricTimeWindowDynamicDuration string
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    MetricTimeWindowSpecificValue string
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    metricTimeWindowDynamicDuration String
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    metricTimeWindowSpecificValue String
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    metricTimeWindowDynamicDuration string
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    metricTimeWindowSpecificValue string
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    metric_time_window_dynamic_duration str
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    metric_time_window_specific_value str
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    metricTimeWindowDynamicDuration String
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    metricTimeWindowSpecificValue String
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.

    LogsAlertDefinitionMetricThreshold, LogsAlertDefinitionMetricThresholdArgs

    ConditionType string
    The type of the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than, more_than_or_equals, less_than_or_equals.
    MetricFilter LogsAlertDefinitionMetricThresholdMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    MissingValues LogsAlertDefinitionMetricThresholdMissingValues
    Configuration for handling missing values in the alert. Only one of replace_with_zero or min_non_null_value_pct is supported. Nested schema for missing_values:
    Rules List<LogsAlertDefinitionMetricThresholdRule>
    The condition rules for the metric threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    EvaluationDelayMs double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    UndetectedValuesManagement LogsAlertDefinitionMetricThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    ConditionType string
    The type of the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than, more_than_or_equals, less_than_or_equals.
    MetricFilter LogsAlertDefinitionMetricThresholdMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    MissingValues LogsAlertDefinitionMetricThresholdMissingValues
    Configuration for handling missing values in the alert. Only one of replace_with_zero or min_non_null_value_pct is supported. Nested schema for missing_values:
    Rules []LogsAlertDefinitionMetricThresholdRule
    The condition rules for the metric threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    EvaluationDelayMs float64
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    UndetectedValuesManagement LogsAlertDefinitionMetricThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType String
    The type of the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than, more_than_or_equals, less_than_or_equals.
    metricFilter LogsAlertDefinitionMetricThresholdMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    missingValues LogsAlertDefinitionMetricThresholdMissingValues
    Configuration for handling missing values in the alert. Only one of replace_with_zero or min_non_null_value_pct is supported. Nested schema for missing_values:
    rules List<LogsAlertDefinitionMetricThresholdRule>
    The condition rules for the metric threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs Double
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    undetectedValuesManagement LogsAlertDefinitionMetricThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType string
    The type of the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than, more_than_or_equals, less_than_or_equals.
    metricFilter LogsAlertDefinitionMetricThresholdMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    missingValues LogsAlertDefinitionMetricThresholdMissingValues
    Configuration for handling missing values in the alert. Only one of replace_with_zero or min_non_null_value_pct is supported. Nested schema for missing_values:
    rules LogsAlertDefinitionMetricThresholdRule[]
    The condition rules for the metric threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    undetectedValuesManagement LogsAlertDefinitionMetricThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    condition_type str
    The type of the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than, more_than_or_equals, less_than_or_equals.
    metric_filter LogsAlertDefinitionMetricThresholdMetricFilter
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    missing_values LogsAlertDefinitionMetricThresholdMissingValues
    Configuration for handling missing values in the alert. Only one of replace_with_zero or min_non_null_value_pct is supported. Nested schema for missing_values:
    rules Sequence[LogsAlertDefinitionMetricThresholdRule]
    The condition rules for the metric threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluation_delay_ms float
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    undetected_values_management LogsAlertDefinitionMetricThresholdUndetectedValuesManagement
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:
    conditionType String
    The type of the alert condition.

    • Constraints: Allowable values are: more_than_or_unspecified, less_than, more_than_or_equals, less_than_or_equals.
    metricFilter Property Map
    The filter to match metric entries for the alert. Nested schema for metric_filter:
    missingValues Property Map
    Configuration for handling missing values in the alert. Only one of replace_with_zero or min_non_null_value_pct is supported. Nested schema for missing_values:
    rules List<Property Map>
    The condition rules for the metric threshold alert.

    • Constraints: The maximum length is 5 items. The minimum length is 1 item. Nested schema for rules:
    evaluationDelayMs Number
    The delay in milliseconds before evaluating the alert condition.

    • Constraints: The maximum value is 2147483647. The minimum value is 0.
    undetectedValuesManagement Property Map
    Configuration for handling the undetected values in the alert. Nested schema for undetected_values_management:

    LogsAlertDefinitionMetricThresholdMetricFilter, LogsAlertDefinitionMetricThresholdMetricFilterArgs

    Promql string
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    Promql string
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    promql String
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    promql string
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    promql str
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    promql String
    The filter is a PromQL expression.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.

    LogsAlertDefinitionMetricThresholdMissingValues, LogsAlertDefinitionMetricThresholdMissingValuesArgs

    MinNonNullValuesPct double
    If set, specifies the minimum percentage of non-null values required for the alert to be triggered.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    ReplaceWithZero bool
    If set to true, missing values will be replaced with zero.
    MinNonNullValuesPct float64
    If set, specifies the minimum percentage of non-null values required for the alert to be triggered.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    ReplaceWithZero bool
    If set to true, missing values will be replaced with zero.
    minNonNullValuesPct Double
    If set, specifies the minimum percentage of non-null values required for the alert to be triggered.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    replaceWithZero Boolean
    If set to true, missing values will be replaced with zero.
    minNonNullValuesPct number
    If set, specifies the minimum percentage of non-null values required for the alert to be triggered.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    replaceWithZero boolean
    If set to true, missing values will be replaced with zero.
    min_non_null_values_pct float
    If set, specifies the minimum percentage of non-null values required for the alert to be triggered.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    replace_with_zero bool
    If set to true, missing values will be replaced with zero.
    minNonNullValuesPct Number
    If set, specifies the minimum percentage of non-null values required for the alert to be triggered.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    replaceWithZero Boolean
    If set to true, missing values will be replaced with zero.

    LogsAlertDefinitionMetricThresholdRule, LogsAlertDefinitionMetricThresholdRuleArgs

    Condition LogsAlertDefinitionMetricThresholdRuleCondition
    The condition for the metric threshold alert. Nested schema for condition:
    Override LogsAlertDefinitionMetricThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    Condition LogsAlertDefinitionMetricThresholdRuleCondition
    The condition for the metric threshold alert. Nested schema for condition:
    Override LogsAlertDefinitionMetricThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionMetricThresholdRuleCondition
    The condition for the metric threshold alert. Nested schema for condition:
    override LogsAlertDefinitionMetricThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionMetricThresholdRuleCondition
    The condition for the metric threshold alert. Nested schema for condition:
    override LogsAlertDefinitionMetricThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition LogsAlertDefinitionMetricThresholdRuleCondition
    The condition for the metric threshold alert. Nested schema for condition:
    override LogsAlertDefinitionMetricThresholdRuleOverride
    The override settings for the alert. Nested schema for override:
    condition Property Map
    The condition for the metric threshold alert. Nested schema for condition:
    override Property Map
    The override settings for the alert. Nested schema for override:

    LogsAlertDefinitionMetricThresholdRuleCondition, LogsAlertDefinitionMetricThresholdRuleConditionArgs

    ForOverPct double
    The percentage of values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    OfTheLast LogsAlertDefinitionMetricThresholdRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    Threshold double
    The threshold value for the alert condition.
    ForOverPct float64
    The percentage of values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    OfTheLast LogsAlertDefinitionMetricThresholdRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    Threshold float64
    The threshold value for the alert condition.
    forOverPct Double
    The percentage of values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    ofTheLast LogsAlertDefinitionMetricThresholdRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    threshold Double
    The threshold value for the alert condition.
    forOverPct number
    The percentage of values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    ofTheLast LogsAlertDefinitionMetricThresholdRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    threshold number
    The threshold value for the alert condition.
    for_over_pct float
    The percentage of values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    of_the_last LogsAlertDefinitionMetricThresholdRuleConditionOfTheLast
    The time window for the alert condition. Nested schema for of_the_last:
    threshold float
    The threshold value for the alert condition.
    forOverPct Number
    The percentage of values that must exceed the threshold to trigger the alert.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    ofTheLast Property Map
    The time window for the alert condition. Nested schema for of_the_last:
    threshold Number
    The threshold value for the alert condition.

    LogsAlertDefinitionMetricThresholdRuleConditionOfTheLast, LogsAlertDefinitionMetricThresholdRuleConditionOfTheLastArgs

    MetricTimeWindowDynamicDuration string
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    MetricTimeWindowSpecificValue string
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    MetricTimeWindowDynamicDuration string
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    MetricTimeWindowSpecificValue string
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    metricTimeWindowDynamicDuration String
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    metricTimeWindowSpecificValue String
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    metricTimeWindowDynamicDuration string
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    metricTimeWindowSpecificValue string
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    metric_time_window_dynamic_duration str
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    metric_time_window_specific_value str
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.
    metricTimeWindowDynamicDuration String
    The time window as a dynamic value.

    • Constraints: The maximum length is 4096 characters. The minimum length is 1 character. The value must match regular expression /^[\\p{L}\\p{N}\\p{P}\\p{Z}\\p{S}\\p{M}]+$/.
    metricTimeWindowSpecificValue String
    The time window as a specific value.

    • Constraints: Allowable values are: minutes_1_or_unspecified, minutes_5, minutes_10, minutes_15, minutes_30, hour_1, hours_2, hours_4, hours_6, hours_12, hours_24, minutes_20, hours_36.

    LogsAlertDefinitionMetricThresholdRuleOverride, LogsAlertDefinitionMetricThresholdRuleOverrideArgs

    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    Priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority string
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority str
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.
    priority String
    The priority of the alert definition.

    • Constraints: Allowable values are: p5_or_unspecified, p4, p3, p2, p1.

    LogsAlertDefinitionMetricThresholdUndetectedValuesManagement, LogsAlertDefinitionMetricThresholdUndetectedValuesManagementArgs

    AutoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    TriggerUndetectedValues bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    AutoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    TriggerUndetectedValues bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe String
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues Boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe string
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    auto_retire_timeframe str
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    trigger_undetected_values bool
    Should trigger the alert when undetected values are detected. If true, alert is triggered.
    autoRetireTimeframe String
    The timeframe for auto-retiring the alert when undetected values are detected.

    • Constraints: Allowable values are: never_or_unspecified, minutes_5, minutes_10, hour_1, hours_2, hours_6, hours_12, hours_24.
    triggerUndetectedValues Boolean
    Should trigger the alert when undetected values are detected. If true, alert is triggered.

    LogsAlertDefinitionNotificationGroup, LogsAlertDefinitionNotificationGroupArgs

    GroupByKeys List<string>
    Group the alerts by these keys.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    Webhooks List<LogsAlertDefinitionNotificationGroupWebhook>
    The settings for webhooks associated with the alert definition.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for webhooks:
    GroupByKeys []string
    Group the alerts by these keys.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    Webhooks []LogsAlertDefinitionNotificationGroupWebhook
    The settings for webhooks associated with the alert definition.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for webhooks:
    groupByKeys List<String>
    Group the alerts by these keys.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    webhooks List<LogsAlertDefinitionNotificationGroupWebhook>
    The settings for webhooks associated with the alert definition.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for webhooks:
    groupByKeys string[]
    Group the alerts by these keys.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    webhooks LogsAlertDefinitionNotificationGroupWebhook[]
    The settings for webhooks associated with the alert definition.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for webhooks:
    group_by_keys Sequence[str]
    Group the alerts by these keys.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    webhooks Sequence[LogsAlertDefinitionNotificationGroupWebhook]
    The settings for webhooks associated with the alert definition.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for webhooks:
    groupByKeys List<String>
    Group the alerts by these keys.

    • Constraints: The list items must match regular expression /^[a-zA-Z0-9_.]+$/. The maximum length is 4096 items. The minimum length is 0 items.
    webhooks List<Property Map>
    The settings for webhooks associated with the alert definition.

    • Constraints: The maximum length is 4096 items. The minimum length is 0 items. Nested schema for webhooks:

    LogsAlertDefinitionNotificationGroupWebhook, LogsAlertDefinitionNotificationGroupWebhookArgs

    Integration LogsAlertDefinitionNotificationGroupWebhookIntegration
    The integration type for webhook notifications. Nested schema for integration:
    Minutes double
    The time in minutes before the notification is sent.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    NotifyOn string
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    Integration LogsAlertDefinitionNotificationGroupWebhookIntegration
    The integration type for webhook notifications. Nested schema for integration:
    Minutes float64
    The time in minutes before the notification is sent.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    NotifyOn string
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    integration LogsAlertDefinitionNotificationGroupWebhookIntegration
    The integration type for webhook notifications. Nested schema for integration:
    minutes Double
    The time in minutes before the notification is sent.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    notifyOn String
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    integration LogsAlertDefinitionNotificationGroupWebhookIntegration
    The integration type for webhook notifications. Nested schema for integration:
    minutes number
    The time in minutes before the notification is sent.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    notifyOn string
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    integration LogsAlertDefinitionNotificationGroupWebhookIntegration
    The integration type for webhook notifications. Nested schema for integration:
    minutes float
    The time in minutes before the notification is sent.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    notify_on str
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.
    integration Property Map
    The integration type for webhook notifications. Nested schema for integration:
    minutes Number
    The time in minutes before the notification is sent.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    notifyOn String
    Indicate if the alert should be triggered or triggered and resolved.

    • Constraints: Allowable values are: triggered_only_unspecified, triggered_and_resolved.

    LogsAlertDefinitionNotificationGroupWebhookIntegration, LogsAlertDefinitionNotificationGroupWebhookIntegrationArgs

    IntegrationId double
    The integration ID for the notification.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    IntegrationId float64
    The integration ID for the notification.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    integrationId Double
    The integration ID for the notification.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    integrationId number
    The integration ID for the notification.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    integration_id float
    The integration ID for the notification.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.
    integrationId Number
    The integration ID for the notification.

    • Constraints: The maximum value is 4294967295. The minimum value is 0.

    Import

    You can import the ibm_logs_alert_definition resource by using id. id Alert id is combination of region, instance_id and alert_def_id.

    Syntax

    
    ```sh
    $ pulumi import ibm:index/logsAlertDefinition:LogsAlertDefinition logs_alert_definition < region >/< instance_id >/< alert_id>;
    ```
    
    

    Example

    $ pulumi import ibm:index/logsAlertDefinition:LogsAlertDefinition logs_alert_definition eu-gb/3dc02998-0b50-4ea8-b68a-4779d716fa1f/4dc02998-0bc50-0b50-b68a-4779d716fa1f
    

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    ibm ibm-cloud/terraform-provider-ibm
    License
    Notes
    This Pulumi package is based on the ibm Terraform Provider.
    ibm logo
    ibm 1.85.0-beta0 published on Wednesday, Oct 29, 2025 by ibm-cloud
      Meet Neo: Your AI Platform Teammate