Skip to main content

Create and Edit Alert Rules

Overview​

An alert rule is a per-cluster match filter. Alerts that match a rule trigger an investigation automatically. There is no auto-investigate toggle and no enable/disable flag: if an alert matches, it is investigated.

Rule Fields​

FieldDescriptionExample
NameDescriptive rule name"Critical production alerts"
Namespace (namespaceName)Regex matching Kubernetes namespacesprod-.*
Severity (severityKey + severityFilter)The label key to read for severity, plus a Go RE2 regex to match its valuekey severity, filter `critical
Label (labelKey + labelFilter)An arbitrary alert label key, plus a Go RE2 regex to match its valuekey team, filter payments

Each rule belongs to a single cluster. Severity and label matching are key + filter pairs: you name the label key, then provide an RE2 regex that its value must match.

Creating a Rule​

  1. Go to Configurations -> Alert Rules
  2. Click Create Rule
  3. Fill in the fields above
  4. Click Save

Creating, updating, and deleting alert rules requires the Admin role.

Editing a Rule​

  1. Go to Configurations -> Alert Rules
  2. Click the rule to edit
  3. Modify the fields
  4. Click Save

Filter Logic​

  • Filters within a single rule use AND logic: all configured conditions must match.
  • Create separate rules for OR logic: any matching rule triggers an investigation.

Example: AND Logic​

Rule: namespace prod-.* AND severity filter critical

  • Matches: a critical alert in the prod-payments namespace
  • Does not match: a warning alert in prod-payments, or a critical alert in staging

Example: OR Logic​

  • Rule 1: severity filter critical (any namespace)
  • Rule 2: namespace prod-payments (any severity)
  • Together they match: any critical alert OR any alert in prod-payments

Deleting Rules​

Delete rules you no longer need from the rules list. This action cannot be undone.

Next Steps​