Create Alert Rule
create_alert_ruleCreate a custom alert rule. Call describe_alert_catalog first.
The rule fires when every threshold in rules holds at once, over the same
rolling window, for the traffic left after every filter in filters. There is
no OR: for alternatives, create a second rule.
Predefined rules cannot be created — they already exist per workspace. Use update_alert_rule to configure one.
name: what to call the rule, 1 to 120 characters.
rules: the thresholds, each {"metric":…, "aggregation":…, "operator":…, "value":…}. At least one, at most 10, and each (metric, aggregation) pair
only once. Operators: lt, lte, gt, gte, eq.
window_minutes: the rolling window every threshold is measured over, 5 to 1440.
filters: optional narrowing, each {"field":…, "operator":…, "values":[…]}.
ANDed. Omit to watch the whole workspace. eq and ne take exactly one
value; in and not_in take one or more. Which operators a field admits is
per field — describe_alert_catalog lists them. Values bind verbatim, so
pass them exactly as the data spells them: span_kind is the raw
OpenInference LLM, not llm, and a lowercased value creates a rule
that saves and then never fires.
channel_ids: where firings are delivered, from list_alert_channels. Supplying
this needs the channels:manage capability, because choosing a destination
is a destination decision. Omitting it leaves the rule on the region's
default webhook.
enabled: whether detection starts immediately. Defaults to true.
workspace: optional workspace id, name, or org-name/workspace-name when the
same name occurs in two of your orgs (defaults to your default).
Example:
Alert me when the checkout agent starts erroring.
{ "name": "create_alert_rule", "arguments": {
"name": "checkout errors",
"filters": [{"field": "service", "operator": "eq", "values": ["checkout"]}],
"rules": [{"metric": "errors", "aggregation": "count", "operator": "gte", "value": 5}]
} }Example:
Tell me if p95 cost per trace goes over two dollars.
{ "name": "create_alert_rule", "arguments": {
"name": "cost spike",
"window_minutes": 60,
"rules": [{"metric": "cost", "aggregation": "p95", "operator": "gt", "value": 2.0}]
} }Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| rules | Yes | ||
| enabled | No | ||
| filters | No | ||
| workspace | No | ||
| channel_ids | No | ||
| window_minutes | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |