createAlert

// The following example creates an alert whose threshold is compared against a named field of each
// result row, so every service the query groups by is tracked as its own contributor. FIELD_VALUE requires
// thresholdField. Payloads are shown as JSON on the wire they are CBOR encoded.
val resp = cloudWatchOmniClient.createAlert {
    spaceId = "a1b2c3d4-5e6f-4a3b-8c9d-0e1f2a3b4c5d"
    profileId = "analyst-readonly"
    name = "service-error-count-elevated"
    description = "Alerts when a service logs more errors than its accepted rate."
    rule = Rule.TelemetryRule(TelemetryRule {
        query = AlertRuleQuery {
            language = QueryLanguage.fromValue("SQL")
            expression = "SELECT resource['attributes']['service.name'] AS service, COUNT(*) AS error_count FROM \"logs.default\" WHERE severityText = 'ERROR' GROUP BY service"
        }
        condition = AlertCondition {
            thresholdMode = ThresholdMode.fromValue("FIELD_VALUE")
            thresholdField = "error_count"
            comparator = Comparator.fromValue("GT")
            warningThreshold = 50.0.toDouble()
            criticalThreshold = 200.0.toDouble()
        }
        evaluation = AlertEvaluation {
            intervalSeconds = 300
            pendingDurationSeconds = 600
            recoveryDurationSeconds = 300
        }
        noData = NoData {
            treatAs = AlertState.fromValue("NODATA")
        }
    }
    )
    notificationsEnabled = true
    notificationRules = listOf<NotificationRule>(
        NotificationRule {
            trigger = NotificationTrigger {
                stateValues = listOf<AlertState>(
                    AlertState.fromValue("CRITICAL")
                )
            }
            target = NotificationTarget {
                type = NotificationTargetType.fromValue("slack")
                arn = "arn:aws:cloudwatch:us-east-1:123456789012:integration/a1b2c3d4-5e6f-4a3b-8c9d-0e1f2a3b4c5d"
                metadata = mapOf<String, String>(
                    "channel" to "oncall-alerts"
                )
            }
        }            
    )
    tags = mapOf<String, String>(
        "Team" to "observability"
    )
    clientToken = "3f2a9c1e-7b04-4d8a-9e15-6c2b8d0f4a73"
}

// The following example creates an alert whose threshold is compared against how many rows the query
// returns, rather than a value within them. COUNT_OF_RESULTS takes no thresholdField. Notifications are
// created disabled, so the alert evaluates and records state without sending anything, and an empty result
// set is treated as OK rather than as missing data. Payloads are shown as JSON on the wire they are CBOR
// encoded.
val resp = cloudWatchOmniClient.createAlert {
    spaceId = "a1b2c3d4-5e6f-4a3b-8c9d-0e1f2a3b4c5d"
    profileId = "analyst-readonly"
    name = "service-checkout-5xx-responses"
    description = "Counts checkout responses that returned a server error."
    rule = Rule.TelemetryRule(TelemetryRule {
        query = AlertRuleQuery {
            language = QueryLanguage.fromValue("SQL")
            expression = "SELECT * FROM \"logs.default\" WHERE resource['attributes']['service.name'] = 'checkout' AND attributes['http.response.status_code'] >= 500"
        }
        condition = AlertCondition {
            thresholdMode = ThresholdMode.fromValue("COUNT_OF_RESULTS")
            comparator = Comparator.fromValue("GT")
            warningThreshold = 10.0.toDouble()
            criticalThreshold = 50.0.toDouble()
        }
        evaluation = AlertEvaluation {
            intervalSeconds = 60
            pendingDurationSeconds = 120
        }
        noData = NoData {
            treatAs = AlertState.fromValue("OK")
        }
    }
    )
    notificationsEnabled = false
}

// The following example creates an alert from a PromQL expression instead of SQL. A PromQL rule
// compares against the series value, which is carried as the value field, so the condition is FIELD_VALUE with
// thresholdField set to value Notifications go to an Amazon SNS topic, whose ARN is the topic itself rather than an
// integration. Payloads are shown as JSON on the wire they are CBOR encoded.
val resp = cloudWatchOmniClient.createAlert {
    spaceId = "a1b2c3d4-5e6f-4a3b-8c9d-0e1f2a3b4c5d"
    profileId = "analyst-readonly"
    name = "checkout-error-rate-promql"
    description = "Alerts on the checkout server error rate over a five-minute window."
    rule = Rule.TelemetryRule(TelemetryRule {
        query = AlertRuleQuery {
            language = QueryLanguage.fromValue("PROMQL")
            expression = "sum by (service_name) (rate(http_server_errors_total{service_name=\"checkout\"}[5m]))"
        }
        condition = AlertCondition {
            thresholdMode = ThresholdMode.fromValue("FIELD_VALUE")
            thresholdField = "value"
            comparator = Comparator.fromValue("GT")
            warningThreshold = 0.05.toDouble()
            criticalThreshold = 0.1.toDouble()
        }
        evaluation = AlertEvaluation {
            intervalSeconds = 300
            pendingDurationSeconds = 300
        }
        noData = NoData {
            treatAs = AlertState.fromValue("NODATA")
        }
    }
    )
    notificationRules = listOf<NotificationRule>(
        NotificationRule {
            trigger = NotificationTrigger {
                stateValues = listOf<AlertState>(
                    AlertState.fromValue("WARNING"),
                    AlertState.fromValue("CRITICAL")
                )
            }
            target = NotificationTarget {
                type = NotificationTargetType.fromValue("sns")
                arn = "arn:aws:sns:us-east-1:123456789012:checkout-oncall"
            }
        }            
    )
}