Alerting profile for custom log events

[campbell_purvis]

Hello. Is it possible to generate an alert (configure an alerting profile) purely for Custom Log Events?

Based on any single occurrence of a log event, I wish to raise an alert. However, I do not want to 'bundle' the alert in with standard Error Alerts - we require a dedicated alerting profile/'queue' for such log events.

Assigning the log event to raise a Custom alert would suffice. However, there is no option to generate a custom alert when defining the detection rules for custom log events.

If this is possible it would allow us to use Dynatrace instead of Splunk for log event alerting which would be nice.

Many thanks, Cam

[wolfgang_beer]

So you don't want to trigger a problem? Just deliver a log info event as alert?

[wolfgang_beer]

another question from my side, what kind of log events are those? Are they related to info only or are they related to any malfunction?

[campbell_purvis]

Hi Wolfgang, thanks for your response. The log events are related to errors, not info. The requirement is to associate them with a specific alerting problem - not the ones in the Generate drop-down (Error|Perf|Availability). The Custom problem would suffice but is not an option.

[wolfgang_beer · Accepted solution]

A feature that is already in the pipeline is the ability to create an AlertingProfile filter based either on specific built in event types or on string filtered title or description messages. See following screenshot. Would that solve your use-case?

[bchintapalli]

@Wolfgang B. I have created an event filter(custom) to mitigate unnecessary disk space alerts for a particular disk. Since configured I am not receiving other alert notifications such as CPU, memory, GC, Response time etc for the alerting profile . What is the correct way of setting up an event filter? how exactly does it work?

[mosharref_hossn]

I am trying to find a way to send notification for a log event based on log event extraction rule. The problem is that in the Alert Profile, the "Event Filter" adds a "AND" statement and that does not work with other severity levels because it will only send alert only if the "Event Filter" is true. 
The only solution I found was to create a separate Alert Profile, but that's not ideal. Too many profiles to manage. 

[campbell_purvis]

Would a custom log event fall under the category of 'built in event type' (available under the 'Filter by any event source' dropdown)?

If so, then yes, that would meet our requirements. What would the rough target date be for release?

[wolfgang_beer · Accepted solution]

No, those fall under custom events. So you have to filter for your own log event titles. If everything runs smooth in testing stage this should be available mid November.

[campbell_purvis]

That is wonderful, thank you so much for the information.