logzio 1.17.1, Apr 14 25

logzio 1.17.1 published on Monday, Apr 14, 2025 by logzio

logzio.AlertV2

Explore with Pulumi AI

logzio 1.17.1 published on Monday, Apr 14, 2025 by logzio

Create AlertV2 Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new AlertV2(name: string, args: AlertV2Args, opts?: CustomResourceOptions);

@overload
def AlertV2(resource_name: str,
            args: AlertV2Args,
            opts: Optional[ResourceOptions] = None)

@overload
def AlertV2(resource_name: str,
            opts: Optional[ResourceOptions] = None,
            search_timeframe_minutes: Optional[float] = None,
            title: Optional[str] = None,
            sub_components: Optional[Sequence[AlertV2SubComponentArgs]] = None,
            notification_emails: Optional[Sequence[str]] = None,
            is_enabled: Optional[bool] = None,
            joins: Optional[Sequence[Mapping[str, str]]] = None,
            alert_notification_endpoints: Optional[Sequence[float]] = None,
            output_type: Optional[str] = None,
            schedule_cron_expression: Optional[str] = None,
            schedule_timezone: Optional[str] = None,
            description: Optional[str] = None,
            correlation_operator: Optional[str] = None,
            suppress_notifications_minutes: Optional[float] = None,
            tags: Optional[Sequence[str]] = None,
            alert_v2_id: Optional[str] = None)

func NewAlertV2(ctx *Context, name string, args AlertV2Args, opts ...ResourceOption) (*AlertV2, error)

public AlertV2(string name, AlertV2Args args, CustomResourceOptions? opts = null)

public AlertV2(String name, AlertV2Args args)
public AlertV2(String name, AlertV2Args args, CustomResourceOptions options)

type: logzio:AlertV2
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args AlertV2Args: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args AlertV2Args: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args AlertV2Args: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args AlertV2Args: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args AlertV2Args: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var alertV2Resource = new Logzio.AlertV2("alertV2Resource", new()
{
    SearchTimeframeMinutes = 0,
    Title = "string",
    SubComponents = new[]
    {
        new Logzio.Inputs.AlertV2SubComponentArgs
        {
            QueryString = "string",
            SeverityThresholdTiers = new[]
            {
                new Logzio.Inputs.AlertV2SubComponentSeverityThresholdTierArgs
                {
                    Severity = "string",
                    Threshold = 0,
                },
            },
            ValueAggregationType = "string",
            AccountIdsToQueryOns = new[]
            {
                0,
            },
            Columns = new[]
            {
                new Logzio.Inputs.AlertV2SubComponentColumnArgs
                {
                    FieldName = "string",
                    Regex = "string",
                    Sort = "string",
                },
            },
            FilterMust = "string",
            FilterMustNot = "string",
            GroupByAggregationFields = new[]
            {
                "string",
            },
            Operation = "string",
            ShouldQueryOnAllAccounts = false,
            ValueAggregationField = "string",
        },
    },
    NotificationEmails = new[]
    {
        "string",
    },
    IsEnabled = false,
    Joins = new[]
    {
        
        {
            { "string", "string" },
        },
    },
    AlertNotificationEndpoints = new[]
    {
        0,
    },
    OutputType = "string",
    ScheduleCronExpression = "string",
    ScheduleTimezone = "string",
    Description = "string",
    CorrelationOperator = "string",
    SuppressNotificationsMinutes = 0,
    Tags = new[]
    {
        "string",
    },
    AlertV2Id = "string",
});

example, err := logzio.NewAlertV2(ctx, "alertV2Resource", &logzio.AlertV2Args{
	SearchTimeframeMinutes: pulumi.Float64(0),
	Title:                  pulumi.String("string"),
	SubComponents: logzio.AlertV2SubComponentArray{
		&logzio.AlertV2SubComponentArgs{
			QueryString: pulumi.String("string"),
			SeverityThresholdTiers: logzio.AlertV2SubComponentSeverityThresholdTierArray{
				&logzio.AlertV2SubComponentSeverityThresholdTierArgs{
					Severity:  pulumi.String("string"),
					Threshold: pulumi.Float64(0),
				},
			},
			ValueAggregationType: pulumi.String("string"),
			AccountIdsToQueryOns: pulumi.Float64Array{
				pulumi.Float64(0),
			},
			Columns: logzio.AlertV2SubComponentColumnArray{
				&logzio.AlertV2SubComponentColumnArgs{
					FieldName: pulumi.String("string"),
					Regex:     pulumi.String("string"),
					Sort:      pulumi.String("string"),
				},
			},
			FilterMust:    pulumi.String("string"),
			FilterMustNot: pulumi.String("string"),
			GroupByAggregationFields: pulumi.StringArray{
				pulumi.String("string"),
			},
			Operation:                pulumi.String("string"),
			ShouldQueryOnAllAccounts: pulumi.Bool(false),
			ValueAggregationField:    pulumi.String("string"),
		},
	},
	NotificationEmails: pulumi.StringArray{
		pulumi.String("string"),
	},
	IsEnabled: pulumi.Bool(false),
	Joins: pulumi.StringMapArray{
		pulumi.StringMap{
			"string": pulumi.String("string"),
		},
	},
	AlertNotificationEndpoints: pulumi.Float64Array{
		pulumi.Float64(0),
	},
	OutputType:                   pulumi.String("string"),
	ScheduleCronExpression:       pulumi.String("string"),
	ScheduleTimezone:             pulumi.String("string"),
	Description:                  pulumi.String("string"),
	CorrelationOperator:          pulumi.String("string"),
	SuppressNotificationsMinutes: pulumi.Float64(0),
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	AlertV2Id: pulumi.String("string"),
})

var alertV2Resource = new AlertV2("alertV2Resource", AlertV2Args.builder()
    .searchTimeframeMinutes(0.0)
    .title("string")
    .subComponents(AlertV2SubComponentArgs.builder()
        .queryString("string")
        .severityThresholdTiers(AlertV2SubComponentSeverityThresholdTierArgs.builder()
            .severity("string")
            .threshold(0.0)
            .build())
        .valueAggregationType("string")
        .accountIdsToQueryOns(0.0)
        .columns(AlertV2SubComponentColumnArgs.builder()
            .fieldName("string")
            .regex("string")
            .sort("string")
            .build())
        .filterMust("string")
        .filterMustNot("string")
        .groupByAggregationFields("string")
        .operation("string")
        .shouldQueryOnAllAccounts(false)
        .valueAggregationField("string")
        .build())
    .notificationEmails("string")
    .isEnabled(false)
    .joins(Map.of("string", "string"))
    .alertNotificationEndpoints(0.0)
    .outputType("string")
    .scheduleCronExpression("string")
    .scheduleTimezone("string")
    .description("string")
    .correlationOperator("string")
    .suppressNotificationsMinutes(0.0)
    .tags("string")
    .alertV2Id("string")
    .build());

alert_v2_resource = logzio.AlertV2("alertV2Resource",
    search_timeframe_minutes=0,
    title="string",
    sub_components=[{
        "query_string": "string",
        "severity_threshold_tiers": [{
            "severity": "string",
            "threshold": 0,
        }],
        "value_aggregation_type": "string",
        "account_ids_to_query_ons": [0],
        "columns": [{
            "field_name": "string",
            "regex": "string",
            "sort": "string",
        }],
        "filter_must": "string",
        "filter_must_not": "string",
        "group_by_aggregation_fields": ["string"],
        "operation": "string",
        "should_query_on_all_accounts": False,
        "value_aggregation_field": "string",
    }],
    notification_emails=["string"],
    is_enabled=False,
    joins=[{
        "string": "string",
    }],
    alert_notification_endpoints=[0],
    output_type="string",
    schedule_cron_expression="string",
    schedule_timezone="string",
    description="string",
    correlation_operator="string",
    suppress_notifications_minutes=0,
    tags=["string"],
    alert_v2_id="string")

const alertV2Resource = new logzio.AlertV2("alertV2Resource", {
    searchTimeframeMinutes: 0,
    title: "string",
    subComponents: [{
        queryString: "string",
        severityThresholdTiers: [{
            severity: "string",
            threshold: 0,
        }],
        valueAggregationType: "string",
        accountIdsToQueryOns: [0],
        columns: [{
            fieldName: "string",
            regex: "string",
            sort: "string",
        }],
        filterMust: "string",
        filterMustNot: "string",
        groupByAggregationFields: ["string"],
        operation: "string",
        shouldQueryOnAllAccounts: false,
        valueAggregationField: "string",
    }],
    notificationEmails: ["string"],
    isEnabled: false,
    joins: [{
        string: "string",
    }],
    alertNotificationEndpoints: [0],
    outputType: "string",
    scheduleCronExpression: "string",
    scheduleTimezone: "string",
    description: "string",
    correlationOperator: "string",
    suppressNotificationsMinutes: 0,
    tags: ["string"],
    alertV2Id: "string",
});

type: logzio:AlertV2
properties:
    alertNotificationEndpoints:
        - 0
    alertV2Id: string
    correlationOperator: string
    description: string
    isEnabled: false
    joins:
        - string: string
    notificationEmails:
        - string
    outputType: string
    scheduleCronExpression: string
    scheduleTimezone: string
    searchTimeframeMinutes: 0
    subComponents:
        - accountIdsToQueryOns:
            - 0
          columns:
            - fieldName: string
              regex: string
              sort: string
          filterMust: string
          filterMustNot: string
          groupByAggregationFields:
            - string
          operation: string
          queryString: string
          severityThresholdTiers:
            - severity: string
              threshold: 0
          shouldQueryOnAllAccounts: false
          valueAggregationField: string
          valueAggregationType: string
    suppressNotificationsMinutes: 0
    tags:
        - string
    title: string

AlertV2 Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The AlertV2 resource accepts the following input properties:

SearchTimeframeMinutes double
SubComponents List<AlertV2SubComponent>
Title string
AlertNotificationEndpoints List<double>
AlertV2Id string
CorrelationOperator string
Description string
IsEnabled bool
Joins List<ImmutableDictionary<string, string>>
NotificationEmails List<string>
OutputType string
ScheduleCronExpression string
ScheduleTimezone string
SuppressNotificationsMinutes double
Tags List<string>

SearchTimeframeMinutes float64
SubComponents []AlertV2SubComponentArgs
Title string
AlertNotificationEndpoints []float64
AlertV2Id string
CorrelationOperator string
Description string
IsEnabled bool
Joins []map[string]string
NotificationEmails []string
OutputType string
ScheduleCronExpression string
ScheduleTimezone string
SuppressNotificationsMinutes float64
Tags []string

searchTimeframeMinutes Double
subComponents List<AlertV2SubComponent>
title String
alertNotificationEndpoints List<Double>
alertV2Id String
correlationOperator String
description String
isEnabled Boolean
joins List<Map<String,String>>
notificationEmails List<String>
outputType String
scheduleCronExpression String
scheduleTimezone String
suppressNotificationsMinutes Double
tags List<String>

searchTimeframeMinutes number
subComponents AlertV2SubComponent[]
title string
alertNotificationEndpoints number[]
alertV2Id string
correlationOperator string
description string
isEnabled boolean
joins {[key: string]: string}[]
notificationEmails string[]
outputType string
scheduleCronExpression string
scheduleTimezone string
suppressNotificationsMinutes number
tags string[]

search_timeframe_minutes float
sub_components Sequence[AlertV2SubComponentArgs]
title str
alert_notification_endpoints Sequence[float]
alert_v2_id str
correlation_operator str
description str
is_enabled bool
joins Sequence[Mapping[str, str]]
notification_emails Sequence[str]
output_type str
schedule_cron_expression str
schedule_timezone str
suppress_notifications_minutes float
tags Sequence[str]

searchTimeframeMinutes Number
subComponents List<Property Map>
title String
alertNotificationEndpoints List<Number>
alertV2Id String
correlationOperator String
description String
isEnabled Boolean
joins List<Map<String>>
notificationEmails List<String>
outputType String
scheduleCronExpression String
scheduleTimezone String
suppressNotificationsMinutes Number
tags List<String>

Outputs

All input properties are implicitly available as output properties. Additionally, the AlertV2 resource produces the following output properties:

CreatedAt string
CreatedBy string
Id string: The provider-assigned unique ID for this managed resource.
UpdatedAt string
UpdatedBy string

CreatedAt string
CreatedBy string
Id string: The provider-assigned unique ID for this managed resource.
UpdatedAt string
UpdatedBy string

createdAt String
createdBy String
id String: The provider-assigned unique ID for this managed resource.
updatedAt String
updatedBy String

createdAt string
createdBy string
id string: The provider-assigned unique ID for this managed resource.
updatedAt string
updatedBy string

created_at str
created_by str
id str: The provider-assigned unique ID for this managed resource.
updated_at str
updated_by str

createdAt String
createdBy String
id String: The provider-assigned unique ID for this managed resource.
updatedAt String
updatedBy String

Look up Existing AlertV2 Resource

Get an existing AlertV2 resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: AlertV2State, opts?: CustomResourceOptions): AlertV2

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        alert_notification_endpoints: Optional[Sequence[float]] = None,
        alert_v2_id: Optional[str] = None,
        correlation_operator: Optional[str] = None,
        created_at: Optional[str] = None,
        created_by: Optional[str] = None,
        description: Optional[str] = None,
        is_enabled: Optional[bool] = None,
        joins: Optional[Sequence[Mapping[str, str]]] = None,
        notification_emails: Optional[Sequence[str]] = None,
        output_type: Optional[str] = None,
        schedule_cron_expression: Optional[str] = None,
        schedule_timezone: Optional[str] = None,
        search_timeframe_minutes: Optional[float] = None,
        sub_components: Optional[Sequence[AlertV2SubComponentArgs]] = None,
        suppress_notifications_minutes: Optional[float] = None,
        tags: Optional[Sequence[str]] = None,
        title: Optional[str] = None,
        updated_at: Optional[str] = None,
        updated_by: Optional[str] = None) -> AlertV2

func GetAlertV2(ctx *Context, name string, id IDInput, state *AlertV2State, opts ...ResourceOption) (*AlertV2, error)

public static AlertV2 Get(string name, Input<string> id, AlertV2State? state, CustomResourceOptions? opts = null)

public static AlertV2 get(String name, Output<String> id, AlertV2State state, CustomResourceOptions options)

resources:  _:    type: logzio:AlertV2    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AlertNotificationEndpoints List<double>
AlertV2Id string
CorrelationOperator string
CreatedAt string
CreatedBy string
Description string
IsEnabled bool
Joins List<ImmutableDictionary<string, string>>
NotificationEmails List<string>
OutputType string
ScheduleCronExpression string
ScheduleTimezone string
SearchTimeframeMinutes double
SubComponents List<AlertV2SubComponent>
SuppressNotificationsMinutes double
Tags List<string>
Title string
UpdatedAt string
UpdatedBy string

AlertNotificationEndpoints []float64
AlertV2Id string
CorrelationOperator string
CreatedAt string
CreatedBy string
Description string
IsEnabled bool
Joins []map[string]string
NotificationEmails []string
OutputType string
ScheduleCronExpression string
ScheduleTimezone string
SearchTimeframeMinutes float64
SubComponents []AlertV2SubComponentArgs
SuppressNotificationsMinutes float64
Tags []string
Title string
UpdatedAt string
UpdatedBy string

alertNotificationEndpoints List<Double>
alertV2Id String
correlationOperator String
createdAt String
createdBy String
description String
isEnabled Boolean
joins List<Map<String,String>>
notificationEmails List<String>
outputType String
scheduleCronExpression String
scheduleTimezone String
searchTimeframeMinutes Double
subComponents List<AlertV2SubComponent>
suppressNotificationsMinutes Double
tags List<String>
title String
updatedAt String
updatedBy String

alertNotificationEndpoints number[]
alertV2Id string
correlationOperator string
createdAt string
createdBy string
description string
isEnabled boolean
joins {[key: string]: string}[]
notificationEmails string[]
outputType string
scheduleCronExpression string
scheduleTimezone string
searchTimeframeMinutes number
subComponents AlertV2SubComponent[]
suppressNotificationsMinutes number
tags string[]
title string
updatedAt string
updatedBy string

alert_notification_endpoints Sequence[float]
alert_v2_id str
correlation_operator str
created_at str
created_by str
description str
is_enabled bool
joins Sequence[Mapping[str, str]]
notification_emails Sequence[str]
output_type str
schedule_cron_expression str
schedule_timezone str
search_timeframe_minutes float
sub_components Sequence[AlertV2SubComponentArgs]
suppress_notifications_minutes float
tags Sequence[str]
title str
updated_at str
updated_by str

alertNotificationEndpoints List<Number>
alertV2Id String
correlationOperator String
createdAt String
createdBy String
description String
isEnabled Boolean
joins List<Map<String>>
notificationEmails List<String>
outputType String
scheduleCronExpression String
scheduleTimezone String
searchTimeframeMinutes Number
subComponents List<Property Map>
suppressNotificationsMinutes Number
tags List<String>
title String
updatedAt String
updatedBy String

Supporting Types

AlertV2SubComponent, AlertV2SubComponentArgs

QueryString string: Provide a Kibana search query written in Lucene syntax. The search query together with the filters select for the relevant logs. Cannot be null - send an asterisk wildcard "*" if not using a search query.
SeverityThresholdTiers List<AlertV2SubComponentSeverityThresholdTier>: Sets a severity label per trigger threshold. If using more than one sub-component, only 1 severityThresholdTiers is allowed. Otherwise, 1 per enum are allowed (for a total of 5 thresholds of increasing severities). Increasing severity must adhere to the logic of the operator. See below for nested schema.
ValueAggregationType string: Specifies the aggregation operator. Can be: "SUM", "MIN", "MAX", "AVG", "COUNT", "UNIQUE_COUNT", "NONE". If "COUNT" or "NONE", value_aggregation_field must be null, and group_by_aggregation_fields fields must not be empty. If any other operator type (other than "NONE" or "COUNT"), value_aggregation_field must not be null.
AccountIdsToQueryOns List<double>: Specify Account IDs to select which accounts the alert should monitor. The alert will be checked only on these accounts.
Columns List<AlertV2SubComponentColumn>: See below for nested schema.
FilterMust string: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
FilterMustNot string: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
GroupByAggregationFields List<string>: Specify 1-3 fields by which to group the results and count them. If you apply a group by operation, the alert returns a count of the results aggregated by unique values.
Operation string: Specifies the operator for evaluating the results. Can be: "LESS_THAN", "GREATER_THAN", "LESS_THAN_OR_EQUALS", "GREATER_THAN_OR_EQUALS", "EQUALS", "NOT_EQUALS".
ShouldQueryOnAllAccounts bool: Defaults to true. Only applicable when the alert is run from the main account. If true, the alert runs on the main account and all associated searchable sub accounts. If false, specify relevant account IDs for the alert to monitor using the account_ids_to_query_on field.
ValueAggregationField string: Selects the field on which to run the aggregation for the trigger condition. Cannot be a field already in use for group_by_aggregation_fields.

QueryString string: Provide a Kibana search query written in Lucene syntax. The search query together with the filters select for the relevant logs. Cannot be null - send an asterisk wildcard "*" if not using a search query.
SeverityThresholdTiers []AlertV2SubComponentSeverityThresholdTier: Sets a severity label per trigger threshold. If using more than one sub-component, only 1 severityThresholdTiers is allowed. Otherwise, 1 per enum are allowed (for a total of 5 thresholds of increasing severities). Increasing severity must adhere to the logic of the operator. See below for nested schema.
ValueAggregationType string: Specifies the aggregation operator. Can be: "SUM", "MIN", "MAX", "AVG", "COUNT", "UNIQUE_COUNT", "NONE". If "COUNT" or "NONE", value_aggregation_field must be null, and group_by_aggregation_fields fields must not be empty. If any other operator type (other than "NONE" or "COUNT"), value_aggregation_field must not be null.
AccountIdsToQueryOns []float64: Specify Account IDs to select which accounts the alert should monitor. The alert will be checked only on these accounts.
Columns []AlertV2SubComponentColumn: See below for nested schema.
FilterMust string: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
FilterMustNot string: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
GroupByAggregationFields []string: Specify 1-3 fields by which to group the results and count them. If you apply a group by operation, the alert returns a count of the results aggregated by unique values.
Operation string: Specifies the operator for evaluating the results. Can be: "LESS_THAN", "GREATER_THAN", "LESS_THAN_OR_EQUALS", "GREATER_THAN_OR_EQUALS", "EQUALS", "NOT_EQUALS".
ShouldQueryOnAllAccounts bool: Defaults to true. Only applicable when the alert is run from the main account. If true, the alert runs on the main account and all associated searchable sub accounts. If false, specify relevant account IDs for the alert to monitor using the account_ids_to_query_on field.
ValueAggregationField string: Selects the field on which to run the aggregation for the trigger condition. Cannot be a field already in use for group_by_aggregation_fields.

queryString String: Provide a Kibana search query written in Lucene syntax. The search query together with the filters select for the relevant logs. Cannot be null - send an asterisk wildcard "*" if not using a search query.
severityThresholdTiers List<AlertV2SubComponentSeverityThresholdTier>: Sets a severity label per trigger threshold. If using more than one sub-component, only 1 severityThresholdTiers is allowed. Otherwise, 1 per enum are allowed (for a total of 5 thresholds of increasing severities). Increasing severity must adhere to the logic of the operator. See below for nested schema.
valueAggregationType String: Specifies the aggregation operator. Can be: "SUM", "MIN", "MAX", "AVG", "COUNT", "UNIQUE_COUNT", "NONE". If "COUNT" or "NONE", value_aggregation_field must be null, and group_by_aggregation_fields fields must not be empty. If any other operator type (other than "NONE" or "COUNT"), value_aggregation_field must not be null.
accountIdsToQueryOns List<Double>: Specify Account IDs to select which accounts the alert should monitor. The alert will be checked only on these accounts.
columns List<AlertV2SubComponentColumn>: See below for nested schema.
filterMust String: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
filterMustNot String: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
groupByAggregationFields List<String>: Specify 1-3 fields by which to group the results and count them. If you apply a group by operation, the alert returns a count of the results aggregated by unique values.
operation String: Specifies the operator for evaluating the results. Can be: "LESS_THAN", "GREATER_THAN", "LESS_THAN_OR_EQUALS", "GREATER_THAN_OR_EQUALS", "EQUALS", "NOT_EQUALS".
shouldQueryOnAllAccounts Boolean: Defaults to true. Only applicable when the alert is run from the main account. If true, the alert runs on the main account and all associated searchable sub accounts. If false, specify relevant account IDs for the alert to monitor using the account_ids_to_query_on field.
valueAggregationField String: Selects the field on which to run the aggregation for the trigger condition. Cannot be a field already in use for group_by_aggregation_fields.

queryString string: Provide a Kibana search query written in Lucene syntax. The search query together with the filters select for the relevant logs. Cannot be null - send an asterisk wildcard "*" if not using a search query.
severityThresholdTiers AlertV2SubComponentSeverityThresholdTier[]: Sets a severity label per trigger threshold. If using more than one sub-component, only 1 severityThresholdTiers is allowed. Otherwise, 1 per enum are allowed (for a total of 5 thresholds of increasing severities). Increasing severity must adhere to the logic of the operator. See below for nested schema.
valueAggregationType string: Specifies the aggregation operator. Can be: "SUM", "MIN", "MAX", "AVG", "COUNT", "UNIQUE_COUNT", "NONE". If "COUNT" or "NONE", value_aggregation_field must be null, and group_by_aggregation_fields fields must not be empty. If any other operator type (other than "NONE" or "COUNT"), value_aggregation_field must not be null.
accountIdsToQueryOns number[]: Specify Account IDs to select which accounts the alert should monitor. The alert will be checked only on these accounts.
columns AlertV2SubComponentColumn[]: See below for nested schema.
filterMust string: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
filterMustNot string: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
groupByAggregationFields string[]: Specify 1-3 fields by which to group the results and count them. If you apply a group by operation, the alert returns a count of the results aggregated by unique values.
operation string: Specifies the operator for evaluating the results. Can be: "LESS_THAN", "GREATER_THAN", "LESS_THAN_OR_EQUALS", "GREATER_THAN_OR_EQUALS", "EQUALS", "NOT_EQUALS".
shouldQueryOnAllAccounts boolean: Defaults to true. Only applicable when the alert is run from the main account. If true, the alert runs on the main account and all associated searchable sub accounts. If false, specify relevant account IDs for the alert to monitor using the account_ids_to_query_on field.
valueAggregationField string: Selects the field on which to run the aggregation for the trigger condition. Cannot be a field already in use for group_by_aggregation_fields.

query_string str: Provide a Kibana search query written in Lucene syntax. The search query together with the filters select for the relevant logs. Cannot be null - send an asterisk wildcard "*" if not using a search query.
severity_threshold_tiers Sequence[AlertV2SubComponentSeverityThresholdTier]: Sets a severity label per trigger threshold. If using more than one sub-component, only 1 severityThresholdTiers is allowed. Otherwise, 1 per enum are allowed (for a total of 5 thresholds of increasing severities). Increasing severity must adhere to the logic of the operator. See below for nested schema.
value_aggregation_type str: Specifies the aggregation operator. Can be: "SUM", "MIN", "MAX", "AVG", "COUNT", "UNIQUE_COUNT", "NONE". If "COUNT" or "NONE", value_aggregation_field must be null, and group_by_aggregation_fields fields must not be empty. If any other operator type (other than "NONE" or "COUNT"), value_aggregation_field must not be null.
account_ids_to_query_ons Sequence[float]: Specify Account IDs to select which accounts the alert should monitor. The alert will be checked only on these accounts.
columns Sequence[AlertV2SubComponentColumn]: See below for nested schema.
filter_must str: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
filter_must_not str: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
group_by_aggregation_fields Sequence[str]: Specify 1-3 fields by which to group the results and count them. If you apply a group by operation, the alert returns a count of the results aggregated by unique values.
operation str: Specifies the operator for evaluating the results. Can be: "LESS_THAN", "GREATER_THAN", "LESS_THAN_OR_EQUALS", "GREATER_THAN_OR_EQUALS", "EQUALS", "NOT_EQUALS".
should_query_on_all_accounts bool: Defaults to true. Only applicable when the alert is run from the main account. If true, the alert runs on the main account and all associated searchable sub accounts. If false, specify relevant account IDs for the alert to monitor using the account_ids_to_query_on field.
value_aggregation_field str: Selects the field on which to run the aggregation for the trigger condition. Cannot be a field already in use for group_by_aggregation_fields.

queryString String: Provide a Kibana search query written in Lucene syntax. The search query together with the filters select for the relevant logs. Cannot be null - send an asterisk wildcard "*" if not using a search query.
severityThresholdTiers List<Property Map>: Sets a severity label per trigger threshold. If using more than one sub-component, only 1 severityThresholdTiers is allowed. Otherwise, 1 per enum are allowed (for a total of 5 thresholds of increasing severities). Increasing severity must adhere to the logic of the operator. See below for nested schema.
valueAggregationType String: Specifies the aggregation operator. Can be: "SUM", "MIN", "MAX", "AVG", "COUNT", "UNIQUE_COUNT", "NONE". If "COUNT" or "NONE", value_aggregation_field must be null, and group_by_aggregation_fields fields must not be empty. If any other operator type (other than "NONE" or "COUNT"), value_aggregation_field must not be null.
accountIdsToQueryOns List<Number>: Specify Account IDs to select which accounts the alert should monitor. The alert will be checked only on these accounts.
columns List<Property Map>: See below for nested schema.
filterMust String: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
filterMustNot String: Runs Elasticsearch Bool Query filters on the data (before the search query is applied). The most efficient way to grab the logs you are looking for.
groupByAggregationFields List<String>: Specify 1-3 fields by which to group the results and count them. If you apply a group by operation, the alert returns a count of the results aggregated by unique values.
operation String: Specifies the operator for evaluating the results. Can be: "LESS_THAN", "GREATER_THAN", "LESS_THAN_OR_EQUALS", "GREATER_THAN_OR_EQUALS", "EQUALS", "NOT_EQUALS".
shouldQueryOnAllAccounts Boolean: Defaults to true. Only applicable when the alert is run from the main account. If true, the alert runs on the main account and all associated searchable sub accounts. If false, specify relevant account IDs for the alert to monitor using the account_ids_to_query_on field.
valueAggregationField String: Selects the field on which to run the aggregation for the trigger condition. Cannot be a field already in use for group_by_aggregation_fields.

AlertV2SubComponentColumn, AlertV2SubComponentColumnArgs

FieldName string: Specify the fields to be included in the notification.
Regex string: Trims the data using regex filters. Learn more.
Sort string: Specify a single field to sort by. The field cannot be an analyzed field (a field that supports free text search or searching by part of a message, such as the 'message' field). Should be: "DESC", "ASC".

FieldName string: Specify the fields to be included in the notification.
Regex string: Trims the data using regex filters. Learn more.
Sort string: Specify a single field to sort by. The field cannot be an analyzed field (a field that supports free text search or searching by part of a message, such as the 'message' field). Should be: "DESC", "ASC".

fieldName String: Specify the fields to be included in the notification.
regex String: Trims the data using regex filters. Learn more.
sort String: Specify a single field to sort by. The field cannot be an analyzed field (a field that supports free text search or searching by part of a message, such as the 'message' field). Should be: "DESC", "ASC".

fieldName string: Specify the fields to be included in the notification.
regex string: Trims the data using regex filters. Learn more.
sort string: Specify a single field to sort by. The field cannot be an analyzed field (a field that supports free text search or searching by part of a message, such as the 'message' field). Should be: "DESC", "ASC".

field_name str: Specify the fields to be included in the notification.
regex str: Trims the data using regex filters. Learn more.
sort str: Specify a single field to sort by. The field cannot be an analyzed field (a field that supports free text search or searching by part of a message, such as the 'message' field). Should be: "DESC", "ASC".

fieldName String: Specify the fields to be included in the notification.
regex String: Trims the data using regex filters. Learn more.
sort String: Specify a single field to sort by. The field cannot be an analyzed field (a field that supports free text search or searching by part of a message, such as the 'message' field). Should be: "DESC", "ASC".

AlertV2SubComponentSeverityThresholdTier, AlertV2SubComponentSeverityThresholdTierArgs

Severity string: Labels the event with a severity tag. Available severity tags are: "INFO", "LOW", "MEDIUM", "HIGH", "SEVERE".
Threshold double: Number of logs per search timeframe.

Severity string: Labels the event with a severity tag. Available severity tags are: "INFO", "LOW", "MEDIUM", "HIGH", "SEVERE".
Threshold float64: Number of logs per search timeframe.

severity String: Labels the event with a severity tag. Available severity tags are: "INFO", "LOW", "MEDIUM", "HIGH", "SEVERE".
threshold Double: Number of logs per search timeframe.

severity string: Labels the event with a severity tag. Available severity tags are: "INFO", "LOW", "MEDIUM", "HIGH", "SEVERE".
threshold number: Number of logs per search timeframe.

severity str: Labels the event with a severity tag. Available severity tags are: "INFO", "LOW", "MEDIUM", "HIGH", "SEVERE".
threshold float: Number of logs per search timeframe.

severity String: Labels the event with a severity tag. Available severity tags are: "INFO", "LOW", "MEDIUM", "HIGH", "SEVERE".
threshold Number: Number of logs per search timeframe.

Package Details

Repository: logzio logzio/terraform-provider-logzio
License
Notes: This Pulumi package is based on the logzio Terraform Provider.

logzio 1.17.1 published on Monday, Apr 14, 2025 by logzio

logzio/terraform-provider-logzio

logzio.AlertV2

On this page

On this page

Create AlertV2 Resource

Constructor syntax

Parameters

Constructor example

AlertV2 Resource Properties

Inputs

Outputs

Look up Existing AlertV2 Resource

Supporting Types

AlertV2SubComponent, AlertV2SubComponentArgs

AlertV2SubComponentColumn, AlertV2SubComponentColumnArgs

AlertV2SubComponentSeverityThresholdTier, AlertV2SubComponentSeverityThresholdTierArgs

Package Details

On this page

On this page