get_alerts
Retrieve LogicMonitor alerts with optional filters for severity, status, device, group, and time range.
Instructions
Get alerts from LogicMonitor with optional filtering
For Kubernetes clusters, use group_id (from get_device_groups) instead of device — the device name filter does not work reliably for K8s resources.
Common mistakes: startEpoch/endEpoch use SECONDS not milliseconds. String filter values need double quotes (e.g., monitorObjectName:"hostname").
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| acked | No | Filter by acknowledged status | |
| limit | No | Max results (max 1000) | |
| sdted | No | Filter by SDT status | |
| device | No | Filter by device name (substring match) | |
| filter | No | Raw filter expression (overrides other filters). Example: severity:4,cleared:false | |
| offset | No | Pagination offset | |
| status | No | Filter by status | |
| cleared | No | Filter by cleared status | |
| group_id | No | Filter by device group ID (matches all devices) | |
| instance | No | Filter by instance name (substring match) | |
| severity | No | Filter by severity | |
| datapoint | No | Filter by datapoint name (substring match) | |
| device_id | No | Filter by device/resource ID | |
| end_epoch | No | Filter alerts started before this epoch timestamp | |
| datasource | No | Filter by datasource/template name (substring match) | |
| start_epoch | No | Filter alerts started after this epoch timestamp |