Trigger a Seq alert when absence of a log message

[ryanbuening]

Hello. I have a unique scenario where I want to trigger a Seq alert and wanted to see if it would be possible.

I have a scheduled job that runs every day the morning and logs out to Seq on successful completion.
I'm wondering if it is possible to create a Seq alert that can detect the absence of this message in the past 24 hours and trigger an alert?

Scenario 1

• Scheduled job runs at 3am
• Logs to Seq: "Success"
• No alert

Scenario 2

• Scheduled job runs at 3am
• No log sent to Seq (error happened or the job didn't run for some reason)
• Seq alert triggered - would want the alert be triggered after a specific time (3am), but before the business day (e.g. 8am) (only once?)
  -- next day --
• Scheduled job runs at 3am the next day
• Logs to Seq: "Success"
• No alert

[nblumhardt]

Hi Ryan,

Using a measurement window of 24 hours and count = 0 as the alert's "having" condition should cover the detection of the absence of the event.

I don't think there's a way to control the time of the notification, currently, unfortunately (I'll give this some more thought...).

Hope this helps,
Nick

[ryanbuening]

Ok. Does the time of notification currently go off of when the alert is created? For example, if I create this alert at 8am (which is possibly when I want this alert to trigger) and I configure the alert like so:

Would that work?

[nblumhardt]

Hi Ryan,

No, unfortunately - there's no correlation between when the alert is created and when it'll be checked.