新遗迹创建基于自定义事件的警报

Question

我们使用它们的https://docs.newrelic.com/docs/insights/event-data-sources/custom-events/apm-report-custom-events接口向New Relic报告自定义事件。

如果在特定时间范围内这些自定义事件的数量超过X，是否有方法创建警报。

SELECT count(*) FROM `event_name` WHERE `field` = 'OFAC' SINCE 30 minutes ago

我收到一个错误：Invalid clauses in alert conditions: SINCE

注意：event_name和field将替换为字符串。

Answer 1

使用nrql警报？

获取nrql查询，然后删除从30分钟开始

SELECT function(属性) FROM Event WHERE属性比较

e.g

nrql_query = "FROM K8sVolumeSample SELECT latest(fsUsedPercent) FACET podName, 
volumeName, pvcName WHERE clusterName IN ('cluster-prod') "

https://docs.newrelic.com/docs/alerts-applied-intelligence/new-relic-alerts/alert-conditions/create-nrql-alert-conditions

我们通过terraform使用它们。文档给出了一个很好的https://registry.terraform.io/providers/newrelic/newrelic/latest/docs/resources/nrql_alert_condition示例

用于仪表板的查询与用于警报的查询相同。对于仪表板，选择count(*) FROM event_name WHERE field = 'OFAC‘自30分钟前开始的时间序列或类似的时间序列

例如，计数示例-获取唯一k8对象的计数

SELECT uniqueCount(K8sNodeSample.entityId) AS 'Nodes', 
uniqueCount(K8sNamespaceSample.clusterName) AS 'Clusters', 
uniqueCount(K8sNamespaceSample.entityId) AS 'Namespaces', 
uniqueCount(K8sDeploymentSample.entityId) AS 'Deployments', 
uniqueCount(K8sPodSample.entityId) AS 'Pods', 
uniqueCount(K8sContainerSample.containerID) AS 'Containers' FROM 
K8sNodeSample, K8sNamespaceSample, K8sDeploymentSample, K8sPodSample, 
K8sContainerSample  WHERE clusterName IN ('cluster-prod')