Custom alerts for Log Monitoring

[danya_matterste]

Hello

I created a metric from log events, the correspondant events normally are very rare, like once or twice a week. But the customer wants an alert if there are more than 15 events coming in half an hour. 
I am very unsure how to configure this in the custom alert.. 
Is there any recommandation? How would you do it?

Thank you for help.

danya

[dannemca]

Your static threshold should the 15, and the minutes slot and period I also have doubt, I would leave the most experience here to help us. But I would go for 1 in 30.

[dannemca · Accepted solution]

Let me correct myself here. The fixed threshold should be 15 only if you do aggregate the events as SUM. Since the custom event works as AVG, do your threshold should be 1, and the timing would be 15 in 30.

[danya_matterste]

I'll try that. Thank You!