Skip to content

Detect and alert

You will learn how to record a metric, watch it with a monitor, deliver alerts to a channel, and read what fired.

This is the end-to-end detect path: a useful query becomes a recorded metric, a monitor watches it, and alerts arrive on a channel when a condition holds.

Before you start

  1. Select a stream in the sidebar.
  2. Ingest events and confirm Fields has the paths you want to measure.
  3. Have an aggregate in mind — for example, error count per minute.

New to the nouns? Read Detect and alert first.

1. Record a metric

A metric is an aggregate query Cordo runs on a schedule and keeps as a series.

  1. Open Query and build an Aggregate (function, optional Group by, filters). See Query events.
  2. Click Save as metric.
  3. Enter a Name and pick Record every — the recording interval.
  4. Click Create metric.

The metric appears on the Metrics page with its query, recording Health, and an Enabled toggle. Expand a row to chart its recorded series.

Shortcut

On the Metrics page, Record event volume creates a count-every-event metric in one click — handy for charting throughput or alerting on silence.

You can also monitor a saved view directly, without recording a metric first — recording is for signals you want to keep and chart.

2. Create a monitor

A monitor evaluates one source and decides when it is in breach.

  1. Open Monitors and click New monitor.
  2. Set a Name and choose a Source — a recorded metric or a saved view.
  3. Pick a Condition:
Condition Fires when
Threshold The value crosses your Operator + Threshold (a zero value is present data, not absence).
Absence No data arrives in the window.
Change The value moves too far vs the prior period — set Compare unit (percent or delta).
Baseline The value deviates from a learned seasonal baseline — set Baseline periods.
  1. Set Window (how much data each check looks at) and Frequency (how often it runs). The form keeps the window aligned to a metric's recording interval and the frequency no larger than the window. Eval offset (default 5m) looks that far behind wall clock so metric recording can catch up; set it to none if you want evaluation on the latest incomplete window.
  2. If the source is grouped, enable Evaluate per group so one series does not mask another.
  3. Save.

A first breach is pending, not an alert: it takes two consecutive breaches to open and two consecutive non-breaches to resolve, and a short cooldown follows a resolve. This is intentional flap suppression — see Detect and alert.

3. Attach notification channels

Until a channel is attached, alerts only appear in-app. The monitor form warns you with No notification channels when that is the case.

Create a channel (on the Streams page, channels panel):

  1. Click New notification channel.
  2. Choose a Type — Webhook, Slack, Email, or PagerDuty.
  3. Fill the destination (Webhook URL / Events API URL / email address) and any optional signing secret.
  4. Save, then use the channel's test action to send a synthetic delivery.

Secrets are write-only

Signing secrets and PagerDuty routing keys are stored encrypted and never shown again after you save. Re-enter a secret only when you want to change it.

Attach it to a monitor: open the monitor's Channels modal and select the channels to notify. A monitor can use several channels; each channel reports its own delivery health.

4. Read alerts

Open Alerts for the incident list on the selected stream.

  • Filter by Monitor and by Status — Firing, Resolved, or All.
  • Open a row to see Alert evidence: the originating monitor, the evaluated window, the values that triggered it (including compare/baseline/deviation), and a bounded list of Contributing events.
  • The evidence view shows a durable investigation path you can share.

Fire-time and resolve-time evidence are immutable, so the observation that opened an alert is still there after the monitor keeps evaluating.

5. Inspect monitor history

Absence of an alert is not proof of health. Open a monitor's history to see what it has actually been doing.

  • Pick a Range: 1h, 6h, 24h, 7d, or Custom (up to 7 days; start must be before end).
  • The status timeline distinguishes healthy, pending, firing, cooldown, no-data/hold, disabled, and error periods; observed values chart alongside it.
  • Gaps in coverage show as unknown, never as healthy.
  • Currently firing and Never evaluated states are called out explicitly.

History is retained for seven days; when a request reaches that boundary the page tells you the retained start.

Next