> ## Documentation Index > Fetch the complete documentation index at: https://test-8ad8522e-feat-ai-sre.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # SLS > Configure alert rules for Alibaba Cloud Log Service (SLS) data sources Monitors retrieves data through SLS SQL query interface (GetLogsV3) and triggers alerts based on query results. ## Core Concepts | Config Item | Description | | ----------------------- | ---------------------------------------------------------------------------- | | **Query Language** | Uses SLS SQL syntax | | **Required Parameters** | Each query must specify `sls.project` and `sls.logstore` | | **Time Range** | Controlled by API parameters; no need to write `WHERE __time__ > ...` in SQL | | **Field Processing** | `__source__` and `__time__` fields are ignored by default | ## 1. Threshold Evaluation Mode This mode is suitable for scenarios requiring threshold comparison on aggregated values. ### Configuration 1. **Query Statement**: Write SLS SQL aggregate query. * Example: Count error log quantity by host in the last 15 minutes. ```sql theme={null} * | SELECT host, count(*) as error_cnt WHERE level = 'ERROR' GROUP BY host ``` 2. **Query Parameters**: * `sls.project`: (Required) Project name. * `sls.logstore`: (Required) Logstore name. * `sls.timespan.value`: (Optional) Time span value, default is 15. * `sls.timespan.unit`: (Optional) Time span unit, supports `s` (seconds), `m` (minutes), `h` (hours), `d` (days). Default is `m`. 3. **Field Mapping**: * **Value fields**: Select `error_cnt` for threshold evaluation. * **Label fields**: Select `host` to identify the alert object. After you select label fields, other non-value fields are carried with the alert as additional information. * See [Query Result Field Mapping](/en/monitors/alert-rules/query-result-fields) for the complete behavior. 4. **Threshold Conditions**: * Use `$A.field_name` to reference values. * Example: `Critical: $A.error_cnt > 50`, `Warning: $A.error_cnt > 10`. ### How It Works Monitors runs the SLS query for the configured time range, distinguishes alert objects by their label fields, and evaluates thresholds with their value fields. If Label fields is empty, every returned field except the value fields becomes a label. ### Recovery Logic | Strategy | Description | | ------------------------------- | --------------------------------------------------------------------------- | | **Auto Recovery** | When values no longer satisfy any alert threshold, automatically recovers | | **Specific Recovery Condition** | Configure recovery expression (e.g., `$A.error_cnt < 5`) | | **Recovery Query** | Independent SQL for recovery evaluation, supports `${label_name}` variables | | **Manual Close** | Keep the alert active until it is closed manually | ## 2. Data Exists Mode This mode is suitable for scenarios where filter logic is written directly in SQL. ### Configuration 1. **Query Statement**: Use `HAVING` clause to filter anomalous data. * Example: Query hosts with error count exceeding 50. ```sql theme={null} * | SELECT host, count(*) as error_cnt WHERE level = 'ERROR' GROUP BY host HAVING error_cnt > 50 ``` 2. **Query Parameters**: Same as above, need to configure `sls.project` and `sls.logstore`. 3. **Evaluation Rules**: As long as query returns data, triggers alert. ### Pros and Cons Analysis | Type | Description | | -------- | --------------------------------------------------------------------- | | **Pros** | Leverages SLS server-side computing power, reducing data transmission | | **Cons** | Cannot differentiate multi-level alerts | ### Recovery Logic * **Recovery When Data Disappears**: When query result is empty, determines recovery * **Recovery Query**: Supports configuring additional query statements * **Manual Close**: Keep the alert active until it is closed manually ## 3. No Data Mode This mode is used to monitor scenarios where "data is expected but actually missing". ### Configuration 1. **Query Statement**: Write a query that is expected to continuously return data. * Example: Query log reporting heartbeat from all hosts. ```sql theme={null} * | SELECT host, max(__time__) as last_seen GROUP BY host ``` 2. **Evaluation Rules**: If a `host` appeared in previous cycles but cannot be found in current and N consecutive cycles, triggers "No Data" alert. ### Recovery Logic No-data alerts support configuring the **alert ending mode**, which decides how the alert ends: | Ending Mode | Description | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **End automatically when data reappears** | Default. The alert ends automatically once the data reappears | | **End when data reappears or the timeout expires** | The alert ends when the data reappears or the automatic close timeout is reached. The timeout is in seconds with a minimum of 1. Available only when the "Alert if previously found data is now missing" mode is enabled | | **Manual close only** | The alert stays active until you close it manually | ## 4. Advanced Configuration If you need to use SLS enhanced SQL syntax, add in query parameters: `sls.powersql: true` Default queries data from the last 15 minutes. Adjustable via parameters: | Parameter | Description | | -------------------- | ---------------------------------------------------------------- | | `sls.timespan.value` | Time span value, like `60` | | `sls.timespan.unit` | Time unit: `s` (seconds), `m` (minutes), `h` (hours), `d` (days) | Do not use `__time__` for filtering in SQL; the engine automatically sets time range based on parameters. In raw log search mode, `sls.lines` controls the maximum number of log rows returned by a single query. Each returned row can produce one alert. | Scenario | Behavior | | ---------------------------------- | ------------------------------------------------------------------------------------------------------ | | **New rules** | Defaults to `1` — only the latest row in the time window is returned | | **Valid range** | An integer between 1 and 100 | | **Empty** | Means this rule has never had this setting, so Edge falls back to its old default of 100 rows | | **Out of range or not an integer** | Explicit validation error on save (prompts for an integer between 1 and 100); never silently corrected | Applies to raw log search only. Aliyun ignores this setting when the query contains SQL. For debugging only; do not configure in production rules: | Parameter | Description | | ---------- | ------------------------- | | `sls.from` | Start timestamp (seconds) | | `sls.to` | End timestamp (seconds) |