Rules in the Cockpit app
The Admin section of Lumen mode edits the three rule types behind the Query API. The JSON the forms send is the one documented there; what each rule does to your data is in Use Lumen.
| Rule | What it does | When it takes effect |
|---|---|---|
| Alert rules | Watch errors or a metric and notify a channel | On data that arrives after saving |
| Ingest rules | Drop or sample entries before they are stored | Immediately; dropped data is gone for good |
| Fingerprint rules | Decide which errors share a group | For new entries only; existing groups are not regrouped |
403 to others and the page says "Only organization admins can manage … rules." A rule whose organization is empty applies to every organization: it shows an all organizations tag and is read-only here.The forms check what they can before sending (lengths, ranges, patterns); the server stays the authority, and a field-level rejection is shown with the field's name.
Alert rules
A table of rules with an on/off switch, the rule in plain words, project, where it sends, severity and last update; filter by project and trigger. New rule opens the editor; Edit and Delete (with confirmation) are on each row.
Triggers
| Trigger | Fires when | Fields |
|---|---|---|
A new error appears (new_group) | The first time an error group is created | level filter, workflow-type filter |
A resolved error comes back (regressed) | A group you resolved occurs again | same |
An error reaches N occurrences (threshold) | One group has happened at least N times | min occurrences, filters |
A metric crosses a threshold (metric_threshold) | A metric over a window is >, >=, < or <= a value | metric, aggregation, operator, threshold, window, for, cooldown, group by, filters |
A metric stops reporting (metric_absent) | A metric sends nothing for the window | metric, window, for, cooldown, group by, filters |
Limits checked in the form, as the server enforces them: window up to 60 minutes (up to 24 hours for Pulse metrics), for up to 24 hours, cooldown up to 7 days, up to 10 filters of the form attrs.key:value or resource_attrs.key:value, and a group-by of project, service_name, attrs.<key> or resource_attrs.<key>. Aggregations are avg, sum, min, max, count, p50, p90, p95, p99.
Pulse numbers can be watched too: pulse.page_views, pulse.visits, pulse.visitors, pulse.events, or pulse.event:<name> for one event. Those take no aggregation or filters.
Channels and severity
| Channel | Needs | Notes |
|---|---|---|
Orkestia ticket (ticket) | nothing | Emits the lumen.alert.fired event that opens a ticket |
Slack webhook (slack) | Webhook URL | Full http(s) URL |
Webhook (webhook) | Webhook URL; optional signing secret | The secret is sent only if you type one; an existing secret shows as set and is kept otherwise |
Email (email) | An address |
Severity is Not set, Critical, High, Medium or Low. Set it before wiring alerts: every new group otherwise pages at the same level (triage loop).
Templates
The editor opens prefilled when a link carries a template:
| Template | Rule |
|---|---|
pulse-down | metric_absent on pulse.page_views, 120-minute window, 6-hour cooldown, severity high |
pulse-goal | metric_threshold on pulse.event:<goal event>: sum below 1 over a day, severity medium. Opened by alert me on a Pulse goal (Pulse) |
Import from Prometheus
Import from Prometheus takes a Prometheus rules file (paste the YAML; there is no file picker), sends it to POST /api/import/alert-rules and previews each rule as translated, approximated or skipped, with the original expression, the reason and notes. Choose where the alerts go (channel and its URL or address) and the project, then create. The result for each rule is shown.
Ingest rules
A rule matches entries by project (* for all), level and source, then either:
| Action | Effect |
|---|---|
| Drop | Throw the entry away. The ingest call still answers 200 { "dropped": true } |
| Sample | Keep a share between 0% and 100% and drop the rest |
The editor shows the rule as a sentence that updates as you type, for example "Keep 25% of debug-level entries from source “health” in every project, drop the rest." Rows have an enable switch, edit and delete.
Fingerprint rules
A fingerprint rule overrides the default fingerprint algorithm: when its regular expression matches, the error is grouped under your fingerprint_key (sha256 of it) instead.
| Field | Meaning |
|---|---|
| Project | * or one project |
| Pattern | A regular expression |
| Match against | The error message, the traceback, or either |
| Group key | The name the matching errors share (required) |
| Title override | Optional title for the group |
| Priority | Whole number; decides between rules that both match |
The Try it box in the editor takes a sample message and traceback and says match, no match, or that the pattern is invalid, as you type.
re, which differs on rare syntax. If a pattern uses unusual syntax, confirm it on the server by watching the next matching error group.Fingerprint rules reshape grouping going forward. Existing groups stay as they are.
Pulse in the Cockpit app
Product analytics in Lumen mode — overview, events, funnels, heatmaps, paths, retention, and creating a browser-restricted Pulse key
Plans, usage and API keys in the Cockpit app
This month's Lumen usage, storage against the cap, the Free / Pro / Enterprise comparison, how plan changes are made, and minting or revoking API keys