list_alerts
Retrieve active alerts from LogicMonitor with simple search or advanced filtering. Filter by severity, acknowledgement status, device, or time to find critical issues requiring attention.
Instructions
List active alerts in LogicMonitor (LM) monitoring.
Returns: Array of alerts with: id (alertId), severity (critical/error/warning), resource name, datasource, datapoint, alert message, start time (startEpoch), acknowledgement status (acked), alert rule.
When to use:
Get all critical production alerts
Find unacknowledged alerts needing attention
Monitor specific service health
Check CPU/memory alerts
Generate alert reports
Two search modes:
Simple search: Use query parameter with free text (e.g., query:"prod-web-01") - searches by resource/device name (monitorObjectName field)
Advanced filtering: Use filter parameter with LM filter syntax (e.g., filter:"severity:critical,acked:false") for precise control
Common filter patterns:
Critical alerts: filter:"severity:critical"
Unacknowledged: filter:"acked:false"
Specific device: filter:"monitorObjectName~*prod-web-01*"
CPU alerts: filter:"resourceTemplateName~*CPU*"
Recent alerts: filter:"startEpoch>1730851200" (epoch seconds)
Combined: filter:"severity:critical,acked:false" (AND logic)
Query vs Filter:
query: Simple text search by resource/device name only (e.g., query:"production", query:"k8s-cluster")
filter: Precise LM filter syntax with any alert field. Use for severity, acked status, etc.
If both provided, query is converted to filter and combined with provided filter using AND logic
Important: Alert API does NOT support OR operator (||). Use comma for AND only. For complex queries, make multiple calls.
Important: A negative "total" value in the response indicates incomplete results. Use pagination (size/offset parameters) or set autoPaginate: true to retrieve all items.
Related tools: "get_alert" (full details), "acknowledge_alert" (acknowledge), "add_alert_note" (add notes), "generate_alert_link" (get URL).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Simple search query. Free text (e.g., "prod-web-01", "k8s-cluster") searches by resource/device name (monitorObjectName). Can also use filter syntax (e.g., "severity:critical") which gets formatted automatically. | |
| size | No | Number of results per page (default: 50, max: 1000). | |
| offset | No | Starting offset for pagination (default: 0). Use this to skip a specific number of results. | |
| autoPaginate | No | Automatically fetch all pages (default: false). When true, fetches all results across multiple pages. When false, returns only the requested page. Use false for large result sets to avoid long response times. | |
| filter | No | Filter expression using LogicMonitor query syntax. Examples: name:*prod*, displayName~*server*, id>100, hostStatus:normal. Available operators: : (equals), ~ (includes), !: (not equals), !~ (not includes), >: (greater than or equals), <: (less than or equals), > (greater than), < (less than). Multiple conditions: Use comma (,) for AND, use || for OR. Do NOT use &&. | |
| fields | No | Comma-separated list of fields to include in response. Examples: "id,displayName,hostStatus" or use "*" for all fields. Omit this parameter to receive a curated set of commonly used fields. | |
| needMessage | No | Whether to include alert message details |