Frequently Asked Questions¶

Error Rules¶

Why is there no data in the list after creating a rule?

Check if the time range includes the period after the rule was created. Confirm that the data source is reporting error data. Verify that the fields meet the requirements.

Why do Resolved errors reappear?

This is the normal mechanism. When the same error occurs again, the system automatically resets its status to Triage to ensure recurring issues are handled. If you do not want it to be reopened, please use the Ignored status.

How to distinguish errors from different environments?

When creating a rule, filter by the env tag (e.g., env:production), or create separate rules for monitoring different environments.

Can I modify the index/service scope of an already created rule?

Yes. After editing the rule, the new data scope takes effect immediately, but historically aggregated error Issues will not be recalculated.

Why does the log rule require the error_type field?

error_type is the core field for generating error fingerprints, used to distinguish between different types of errors. If it is not present in the original logs, please use Pipeline to map it from log levels (e.g., ERROR/WARN) or error code fields.

Will multiple rules monitoring the same data generate duplicate Issues?

No. The system deduplicates based on issue_id. The same error will only generate one Issue even if it matches multiple rules.

Error List¶

Why is the number of errors in the list inconsistent with the number of original logs?

This is the normal result of aggregation. The Incident center merges multiple occurrences of the same root cause into one Issue, so the list count will be much smaller than the original error count. You can view the cumulative occurrence count on the right side of a single error card.

How to view all occurrence records of a specific error?

In the "Error Distribution Chart" on the error details page, you can view the occurrence trend of that error within the time range. To view the original data of a single occurrence, click "Associated Trace".

Will there be a notification when a Resolved error reappears?

Yes. When a Resolved error occurs again, the system automatically resets its status to Triage.