Preview Feature ​

Cribl is still developing this Preview feature. We don’t recommend using it in a production environment, because the feature might not be fully tested or optimized for performance, and related documentation could be incomplete.

Please continue to submit feedback through normal Cribl support channels, but assistance might be limited while the feature remains in Preview.

Get notified when a metric moves outside its expected range, using Monitors.

About Monitors ​

A Monitor watches a metric query and raises an alert when the metric meets a condition you define, such as crossing a threshold or behaving anomalously.

• A Monitor is what keeps watch - a metric query, its detection method, thresholds, and firing conditions.
• An alert is the recorded moment a Monitor’s condition was met.
• A Notification delivers that alert to where your team works, such as email, Slack, or a webhook.

Monitors are part of the Metrics experience. To explore and visualize metrics before you alert on them, see Explore Metrics in Cribl Search.

During Preview, some routing and suppression controls are not yet wired up - the sections below call out what is coming soon.

Open Monitors ​

On the Cribl.Cloud top bar, select Products > Search > Monitors.

From the Monitors list, you can:

• Search and filter your Monitors.
• Enable or disable a Monitor with its row toggle.
• Select Monitors for bulk actions.
• Select Add Monitor to create one, or select an existing Monitor to edit it.

Build a Monitor ​

The Monitor page has a live preview chart at the top. Expand the sections below the chart to configure your Monitor settings.

• Turn Simulate on past data on to preview how the Monitor would have behaved against recent data.
• Use the Enabled toggle in the header to turn the Monitor on or off, then select Save.

Configure the Monitor in these sections:

1. Detection Method: choose how the Monitor fires.
2. General: name the Monitor and set its priority and team.
3. Query: choose the metric and shape the query.
4. Thresholds: map values to severities.
5. Metadata: attach key-value labels to alerts.
6. Firing Conditions: control how long a condition must hold.
7. Notifications: decide how alerts are delivered.

When you edit an existing Monitor, the page splits into a Configure tab and an Activity tab. See View Alert Activity.

Detection Method ​

The Detection Method determines how the Monitor decides to fire an alert. Select one:

General ​

• Name: a unique name for the Monitor. Required.
• Description: a short note on what the Monitor checks and why it matters.
• Priority: the urgency of the Monitor: P1 (Critical), P2 (High), P3 (Medium), P4 (Low), P5 (Info), or Not defined.
• Team: the team that owns the Monitor.

Query ​

The Query section defines what the Monitor evaluates. You can build the query visually or write PromQL directly.

Visual builder:

• Metric: the base metric to evaluate.
• Label filters: narrow the series with key-value matchers. Operators are =, !=, =~ (regex), and !~ (regex not).
• Aggregation: how samples roll up over the window: count, avg, sum, min, or max.
• Group by: one or more labels to evaluate as separate series.
• Evaluation window: the rolling lookback, such as 5m or 1h.

PromQL:

• Enter PromQL directly in the query editor.
• Use $variable in the query to add template parameters. Cribl Search shows a Resolved Query preview with the parameter values filled in.

You can add more than one query, labeled A through D, and give the Monitor a Units value (such as seconds, bytes, or count) so charts and thresholds read correctly.

Thresholds ​

Thresholds map evaluated values to severities in a Default Rule. For each row, configure:

• Severity: Critical, Warning, or Info.
• Operator: greater than, greater than or equal, less than, less than or equal, equal to, or not equal to.
• Threshold: the numeric value to compare against.
• Times Triggered: the number of consecutive evaluations the condition must hold before the alert fires. The minimum is 1.

Select Add severity to add a row (up to six). Turn on Show on Chart to draw the threshold on the preview chart.

Use Included Tags and Excluded Tags to scope the rule to specific series.

Metadata ​

Add arbitrary key-value pairs, such as env=prod or team=platform. These become labels on every alert the Monitor generates, so Notification policies and templates can use them for routing and formatting.

Firing Conditions ​

Firing Conditions control how long a condition must hold before an alert opens or clears. This is how Monitors avoid alert flapping when a metric hovers around a threshold.

• Fire delay: how long the condition must stay true before the alert fires.
• Clear delay: how long the condition must stay healthy before the alert clears.

Both accept Immediate, 1 minute, 5 minutes, 10 minutes, 15 minutes, 30 minutes, or 1 hour. Set the Clear delay together with Times Triggered to smooth out noisy metrics.

Notifications ​

Choose how alerts are delivered:

• Route via Notification Policies: route alerts by matching their labels against shared policies. Policies are evaluated top-down, and each matching policy processes the alert until a final policy ends routing.
• Select Specific Notification Target: send directly to a chosen target, bypassing policies.

To create and manage the Targets, Templates, and Policies that these options use, see Manage Monitor Notifications.

Mute a Monitor ​

Muting suppresses a Monitor’s notifications during a planned window, such as scheduled maintenance, without disabling the Monitor or losing alert history.

During Preview, Add Muting Rule is coming soon. The button appears on the Monitor page but is not yet active.

View Alert Activity ​

When you edit a Monitor, the Activity tab shows its history, so you can review when it fired and how it changed over time. The Alerts area also has an Activity tab across all Monitors.

Next Steps ​

• Explore Metrics in Cribl Search
• Add Metrics to Dashboards
• Ingest Prometheus Metrics into Cribl Search