Our docs are moving…

Check out our new Alerts Doc.


Set up alerts to get notified about log events that matter. Get emailed if a dictionary attack is under way or when critical errors are reported in your logs. Prevent system downtime by getting notified about issues before they become fatal.

Creating Alerts

To create an alert simple fill out the same fields as you would for an Tag, before pressing the create button you need to press the Add Alert button (seen below). Now fill out the fields to your preference (See below for more information). Once you have all fields filled out by the Creating button to create the Tag and Alert.

Specify limitations

Specify how often the event must occur before an alert is triggered. Also specify how often you would like to be notified. This allows you to avoid flooding your inbox with notifications and to get alerts when they really matter. With the option It must match at least you can specify how many times the pattern MUST match in order to trigger the alert. The most common option Once triggers the alert on every occurrence. A more refined option 100x/hour specifies that the pattern must match at least 100 times in the last 60 minutes. The alert is triggered when our alert counter reaches this limit. However, note that it does not trigger again if the pattern is continually matched above the threshold: the counter must drop again below the limit, and then again over the threshold to be re-triggered. This allows us to avoid flooding you with alert reports. Option Report this alert at most enables you to limit the amount of alert reports you receive. You can thus easily avoid getting flooded with reports of the same alert, while making sure you still get the most important ones. All time specifications (last hour, last day), represent a sliding window. That means the time window specified is not fixed for the current hour or day, but instead it slides with the current time and refers to last 60 minutes or 24 hours. This is more convenient than a fixed-hour/day time specification: Attacks or errors do not respect hour or day boundaries.

Specify notification style

Notifications can be sent by email, iPhone messaging, or you can specify a URL where the notification should be sent if you would rather use webhooks. Webhook is POSTed information about the alert triggered in JSON format for easy parsing. Logentries sends webhooks to your server in real-time so your server does not need to poll for changes.


Defining an Exact Match

files will alert on entries such as /media/files/doc Note exact matching will not match substrings like Myfiles

Regular Expressions

For regular expressions start the query with a slash /. Note using a slash / will also handling substrings. E.g. /file will alert on an exact match and substrings Some useful patterns:
  • /.+@.+\.[a-z]+ Match an email
  • /\d{5,7} Match a 5-7 digit id
  • /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} Match any IP address
Check out pattern details
Back to Top