Our docs are moving…

Check out our new Tags & Alerts Doc.

Tags & Alerts

Tags and Basic Alerts

Dynamic tags contain custom terms that enable easy searching and filtering for events that matter the most to your business. Basic Real-time Alerts are built using these custom tags and set to notify you and your team based on specific thresholds and preferences. Users can select to be notified with real-time Alerts via Slack, PagerDuty, HipChat, Campfire, iPhone app, or Webhook.

Additional Resources

This document will cover Tags and Basic alerts. Additionally, Logentries provides powerful advanced alerting functions. More information about our advanced alerts as well as other useful resources can be found below:

  • Anomaly Detection – Set-up real-time alerting based on deviations from important patterns and log events.
  • Inactivity Alerting – Monitor specific incoming log events and patterns, and receive real-time alerts on inactivity or system behavior changes.
  • Team Annotations – Add notes, commentary and context to live log data for team-wide visibility and intelligence about what is happening across the systems.
  • Regular Expression Keyword Search – Regular Expressions can be used to specify patterns for Tag & Alerts.

Create a Tag

To create a tag begin by clicking the Tags & Alerts icon on the main Navigation Bar on the left side of the Web UI.


From here you will enter the Tag & Alerts creation page. To set up a Basic Tag, you will enter a Tag Name, a Pattern, and a Label.

  • Tag Name: Defines the name that will be displayed in the tag list.
  • Pattern: Defines the query used to match the log events that should be tagged.
NOTE: Logical operators like ‘AND’ must be uppercase. Pattern field should not contain the where() clause.


Label: This is how the tag will display in your logs. Create a new label by clicking the Create New Label button.


The New Label screen will allow you to enter the name that will be shown with your label as will as pick a color for the label. You can also choose a custom color for your label if desired.


The last step is to choose which logs this tag will apply to:


Using a Tag as a Filter

Tags provide a visual cue in your log event to help you identify important events. Additionally, tags can be used as a filter.
When looking at tags in your log data, the tags that have occurred in the current time frame will be listed across the top of the log data. The number next to the tag names represents the number of occurrences of that tag in the given time frame.


Clicking on one of the tag names from the top bar will apply a filter so that only log events that meet the pattern for the specified tag are shown.

Create An Alert

Alerts will automatically notify you when important events happen within your system.

  • Match: How many times the event must occur in a given time frame to trigger an alert
  • Report: Sets a limit for the maximum amount of alert notifications you want to receive in the selected time frame.
  • Send to: Send the alert to any email address or choose another pre-integrated method such as Slack, PagerDuty, HipChat, Campfire, iPhone app, or Webhook.


Now click the save button at the bottom of the page.

Import Best Practice Tags and Alerts

Not sure which tags and alerts to create in your account? Logentries community packs contain pre-defined technology specific tags and alerts that can be added to your account in seconds.


When using the Tags and Alert forms there are some restrictions in what you can enter for the fields. The below is a list of some of the restrictions on the form.
  • Label names can not be greater than 30 characters in length.
  • For a given Tag patterns can not be exceed 1000 characters in length.
  • If an alert follows multiple log files it will alert if the total number of matched events across all the logs exceed the defined threshold. E.g. If an alert is monitoring two log files for stack traces with an alert threshold 50 in an hour, the alert will trigger if the first log has 30 matching events and the second log generates 20 matching events.
Back to Top