Alert template catalog
When you author a rule (Authoring rules), you start from a template — a pre-built condition you fill in with a threshold and scope — or write a raw expression. These are the built-in templates, by category.
Templates that reference Kubernetes metrics (the kubernetes and most infrastructure ones) only fire against agent-collected data, so they need a Kubernetes/Docker source — not an OTel-only service source.
Application
| Template | Fires when |
|---|---|
high_error_rate | The error-log rate in a service exceeds your threshold |
http_5xx_rate | The HTTP 5xx rate exceeds your threshold |
request_latency_p99 | p99 request latency exceeds your threshold |
log_pattern_match | Logs matching a regex exceed a rate threshold |
queue_backlog | Queue depth exceeds your threshold |
composite | Two sub-expressions (A and B) combine with AND / OR |
Adaptive (baseline-aware)
| Template | Fires when |
|---|---|
simple_anomaly | The latest value deviates from its learned baseline by N standard deviations |
metric_change_percent | A metric's absolute change over the window exceeds your threshold |
> Despite the key name, metric_change_percent thresholds on the absolute delta, not a percentage. (Its display name is "Metric Change (Delta)".)
Infrastructure
| Template | Fires when |
|---|---|
high_cpu | Average container CPU usage exceeds your threshold |
high_memory | Node memory utilisation exceeds a percentage threshold |
low_disk | Free disk percentage falls below your threshold |
certificate_expiring | A TLS certificate expires within N days |
Kubernetes
| Template | Fires when |
|---|---|
pod_pending | A pod is stuck in Pending beyond the sustain window |
pod_crashloop | Container restart count grows rapidly (CrashLoopBackOff) |
kube_pod_not_ready | A pod is in Failed or Unknown phase |
kube_deployment_replicas | A deployment has unavailable replicas |
deployment_zero_available | A deployment has zero available replicas (full outage) |
node_not_ready | A node's Ready condition is false |
Not a template — raw expressions
For anything the templates don't cover, switch the rule to expression mode and write the condition directly. See Authoring rules.