From ff35c17fc5acff7ec8053837ea17eb5e81e3fb42 Mon Sep 17 00:00:00 2001 From: Haley Wang Date: Wed, 20 May 2026 21:57:10 +0800 Subject: [PATCH 1/2] docs: update alerting rule example to include templating for a label with a dot in its name --- docs/victorialogs/vmalert.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/docs/victorialogs/vmalert.md b/docs/victorialogs/vmalert.md index 75cc376658..f86eaf987a 100644 --- a/docs/victorialogs/vmalert.md +++ b/docs/victorialogs/vmalert.md @@ -106,8 +106,7 @@ for more details. The `expr` query must contain [`stats` pipe](https://docs.victoriametrics.com/victorialogs/logsql/#stats-pipe) in order to calculate some metric over the selected logs, and use this metric in alerting threshold. Use [`filter` pipe](https://docs.victoriametrics.com/victorialogs/logsql/#filter-pipe) -for filtering the calculated metric according to the needed threshold. For example, the following alerting rule fires -if the number of logs with the `error` or `warn` status in `env=prod` exceeds 10 during the last 5 minutes: +for filtering the calculated metric according to the needed threshold. For example, the following alerting rule fires if the number of `error` or `warn` logs on a single pod in `env=prod` exceeds 10 during the last 5 minutes: ```yaml groups: @@ -116,9 +115,9 @@ groups: interval: 5m rules: - alert: HasMoreThan10ErrorLogs - expr: '{env=prod} status:in(error,warn) | stats count() as error_logs | filter error_logs:>10' + expr: '{env=prod} status:in(error,warn) | stats by (k8s.pod.name) as error_logs | filter error_logs:>10' annotations: - description: 'Too big number of errors and warnings during the last 5 minutes: {{$value}}' + description: 'Too big number of errors and warnings on pod {{ index .Labels "k8s.pod.name" }} during the last 5 minutes: {{$value}}' ``` It is possible to group the calculated metrics by arbitrary log fields, by using [`stats by (...)` pipe](https://docs.victoriametrics.com/victorialogs/logsql/#stats-by-fields). From cf5261a442e9ba176659d0f420e2632efdffd19a Mon Sep 17 00:00:00 2001 From: Haley Wang Date: Wed, 20 May 2026 22:07:55 +0800 Subject: [PATCH 2/2] fix expr --- docs/victorialogs/vmalert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/victorialogs/vmalert.md b/docs/victorialogs/vmalert.md index f86eaf987a..e3fcb0dded 100644 --- a/docs/victorialogs/vmalert.md +++ b/docs/victorialogs/vmalert.md @@ -115,7 +115,7 @@ groups: interval: 5m rules: - alert: HasMoreThan10ErrorLogs - expr: '{env=prod} status:in(error,warn) | stats by (k8s.pod.name) as error_logs | filter error_logs:>10' + expr: '{env=prod} status:in(error,warn) | stats by (k8s.pod.name) count() as error_logs | filter error_logs:>10' annotations: description: 'Too big number of errors and warnings on pod {{ index .Labels "k8s.pod.name" }} during the last 5 minutes: {{$value}}' ```