Updated on 2026-01-05 GMT+08:00

Querying a Keyword Alarm Rule

Function

This API is used to query a keyword alarm.

URI

GET /v2/{project_id}/lts/alarms/keywords-alarm-rule

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Project ID. For details about how to obtain a project ID, see Obtaining the Project ID, Account ID, Log Group ID, and Log Stream ID.

Minimum: 32

Maximum: 32

Request Parameters

Table 2 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

User token obtained from IAM. For details about how to obtain a user token, see Obtaining a User Token.

Minimum: 1000

Maximum: 2000

Content-Type

Yes

String

Set this parameter to application/json;charset=UTF-8.

Minimum: 30

Maximum: 30

Response Parameters

Status code: 200

Table 3 Response body parameters

Parameter

Type

Description

keywords_alarm_rules

Array of KeywordsAlarmRuleRespList objects

Project ID.

Table 4 KeywordsAlarmRuleRespList

Parameter

Type

Description

projectId

String

Project ID.

keywords_alarm_rule_id

String

Keyword alarm ID.

keywords_alarm_rule_name

String

Keyword alarm rule name.

keywords_alarm_rule_description

String

Keyword alarm description.

keywords_requests

Array of KeywordsRequest objects

Keyword details.

frequency

Frequency object

Alarm statistical period.

keywords_alarm_level

String

Alarm severity.

keywords_alarm_send

Boolean

Whether to send an alarm.

domain_id

String

Domain ID

create_time

Long

Creation time (timestamp in milliseconds).

update_time

Long

Update time (timestamp in milliseconds).

topics

Array of Topics objects

Notification topic, which will be unavailable soon. You are advised to use the action rule function.

status

String

Alarm status.

trigger_condition_count

Integer

Number of queries in which the triggering condition is met. The default value is 1.

trigger_condition_frequency

Integer

Number of times that log events meet the trigger condition. The default value is 1.

whether_recovery_policy

Boolean

Whether to enable the alarm clearance notification. The default value is false.

recovery_policy

Integer

Number of queries in which the triggering condition is not met. The alarm is cleared when this number reaches the value (3 by default) of this parameter.

notification_frequency

Integer

Notification frequency, in minutes.

alarm_action_rule_name

String

Alarm action rule name.

id

String

The value is the same as that of keywords_alarm_rule_id.

indexId

String

The value is the same as that of keywords_alarm_rule_id.

key

String

The value is the same as that of keywords_alarm_rule_id.

condition_expressions

condition_expressions object

Alarm information.

language

String

Language.

route_group_rule

String

tags

Array of Map<String,String> objects

Tag.

alarm_rule_alias

String

Alarm rule alias.

Table 5 KeywordsRequest

Parameter

Type

Description

log_stream_id

String

Log stream ID.

log_stream_name

String

Log stream name.

log_group_id

String

Log group ID.

log_group_name

String

Log group name.

keywords

String

Keyword.

condition

String

Alarm condition.

number

Integer

Keyword threshold, which forms a condition with keyword and condition. An alarm is triggered when the condition is met.

search_time_range

Integer

Time range for querying the latest data when a task is executed.

search_time_range_unit

String

Query time unit.

conditions

conditions object

Condition information.

log_group_name_alias

String

Log group alias.

log_stream_name_alias

String

Log stream alias.

eps_id

String

Enterprise project ID.

Table 6 conditions

Parameter

Type

Description

alarm_level

String

Alarm severity.

condition

String

Condition.

number

String

Quantity.

Table 7 Frequency

Parameter

Type

Description

type

String

Time type.

cron_expr

String

Cron expression, which uses the 24-hour format and is precise down to the minute.

• 0/10 * * * *: The query starts from 00:00 and is performed every 10 minutes at 00:00, 00:10, 00:20, 00:30, 00:40, 00:50, 01:00, and so on. For example, if the current time is 16:37, the next query is at 16:50.

• 0 0/5 * * *: The query starts from 00:00 and is performed every 5 hours at 00:00, 05:00, 10:00, 15:00, 20:00, and so on. For example, if the current time is 16:37, the next query is at 20:00.

• 0 14 * * *: The query is performed at 14:00 every day.

• 0 0 10 * *: The query is performed at 00:00 on the 10th day of every month.

hour_of_day

Integer

This field is used when type is set to DAILY or WEEKLY.

DAILY ranges from 0 to 23.

WEEKLY ranges from 0 to 23.

day_of_week

Integer

This field is used when type is set to WEEKLY (from Sunday to Saturday).

fixed_rate

Integer

Value of a period. This field is used when type is set to FIXED_RATE. It is used together with fixed_rate_unit to indicate a fixed period.

fixed_rate_unit

String

Unit of a period. This field is used when type is set to FIXED_RATE. It is used together with fixed_rate to indicate a fixed period.

The value can be hour or minute.

Table 8 Topics

Parameter

Type

Description

name

String

Topic name.

topic_urn

String

Specifies the resource identifier of the topic, which is unique.

display_name

String

Specifies the topic display name, which is presented as the name of the email sender in email messages.

push_policy

Integer

Specifies the message push policy.

Table 9 condition_expressions

Parameter

Type

Description

alarm_level

String

Alarm severity.

condition_expression

String

Condition expression.

Status code: 500

Table 10 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

Example Requests

Querying a keyword alarm rule

GET https://{endpoint}/v2/{project_id}/lts/alarms/keywords-alarm-rule

/v2/{project_id}/lts/alarms/keywords-alarm-rule

Example Responses

Status code: 200

The request is successful.

{
  "keywords_alarm_rules" : [ {
    "alarm_action_rule_name" : "",
    "alarm_rule_alias" : "test***",
    "condition_expressions" : [ {
      "alarm_level" : "CRITICAL",
      "condition_expression" : "Matching Log Events>1"
    } ],
    "create_time" : 1749200132811,
    "domain_id" : "2e39e6a856bc432682467bb5a775e2d4",
    "frequency" : {
      "cron_expr" : "",
      "day_of_week" : 1,
      "fixed_rate" : 1,
      "fixed_rate_unit" : "minute",
      "hour_of_day" : 0,
      "type" : "FIXED_RATE"
    },
    "id" : "e772fbaf-f189-*********-36e7b2133e61",
    "indexId" : "e772fbaf-f189-*********-36e7b2133e61",
    "key" : "e772fbaf-f189-*********-36e7b2133e61",
    "keywords_alarm_level" : "CRITICAL",
    "keywords_alarm_rule_description" : "test****",
    "keywords_alarm_rule_id" : "e772fbaf-f189-*********-36e7b2133e61",
    "keywords_alarm_rule_name" : "alarm-rule",
    "keywords_alarm_send" : false,
    "keywords_requests" : [ {
      "condition" : ">",
      "conditions" : [ {
        "alarm_level" : "CRITICAL",
        "condition" : ">",
        "number" : 1
      } ],
      "eps_id" : "0",
      "keywords" : "log",
      "log_group_id" : "805e87e5-a61a-*********-2bbb83618b22",
      "log_group_name" : "lts-group-test",
      "log_group_name_alias" : "lts-group-mwb530",
      "log_stream_id" : "f42b5e80-efb9-*********-b67d62e30b1a",
      "log_stream_name" : "lts-topic-xdcf1",
      "log_stream_name_alias" : "lts-topic-test",
      "number" : 1,
      "search_time_range" : 5,
      "search_time_range_unit" : "minute"
    } ],
    "language" : "en-us",
    "notification_frequency" : 0,
    "projectId" : "4a4eb741b4fe440****************",
    "recovery_policy" : 3,
    "route_group_rule" : "",
    "status" : "RUNNING",
    "tags" : [ ],
    "topics" : [ ],
    "trigger_condition_count" : 1,
    "trigger_condition_frequency" : 1,
    "update_time" : 1749633407142,
    "whether_recovery_policy" : false
  } ]
}

Status code: 500

The server has received the request but encountered an internal error.

{
  "error_code" : "LTS.2008",
  "error_msg" : "Find Alarm rule failed."
}

Status Codes

Status Code

Description

200

The request is successful.

500

The server has received the request but encountered an internal error.

Error Codes

See Error Codes.