Get started with Grafana Alerting

By Antonio Calero Merello

Last update on May 29, 2024

Beginner

Introduction

In this guide, we’ll walk you through the process of setting up your first alert in just a few minutes. You’ll witness your alert in action with real-time data, as well as sending alert notifications.

In this tutorial you will:

Create a contact point.
Set up an alert rule.
Receive firing and resolved alert notifications in a public webhook.

Before you begin

Grafana Cloud users

As a Grafana Cloud user, you don’t have to install anything. Continue to Create a contact point.

Grafana OSS users

In order to run a Grafana stack locally, ensure you have the following applications installed.

Docker Compose (included in Docker for Desktop for macOS and Windows)
Git

Set up the Grafana Stack (OSS users)

To demonstrate the observation of data using the Grafana stack, download the files to your local machine.

Clone the tutorial environment repository.

git clone https://github.com/grafana/tutorial-environment.git

Change to the directory where you cloned the repository:
```
cd tutorial-environment
```
Run the Grafana stack:
```
docker compose up -d
```
The first time you run docker compose up -d, Docker downloads all the necessary resources for the tutorial. This might take a few minutes, depending on your internet connection.
Note
If you already have Grafana, Loki, or Prometheus running on your system, you might see errors, because the Docker image is trying to use ports that your local installations are already using. If this is the case, stop the services, then run the command again.

Create a contact point

Besides being an open-source observability tool, Grafana has its own built-in alerting service. This means that you can receive notifications whenever there is an event of interest in your data, and even see these events graphed in your visualizations.

In this step, we’ll set up a new contact point. This contact point will use the webhooks integration. In order to make this work, we also need an endpoint for our webhook integration to receive the alert. We will use Webhook.site to quickly set up that test endpoint. This way we can make sure that our alert is actually sending a notification somewhere.

In your browser, sign in to your Grafana Cloud account.
Note
OSS users: To log in, navigate to localhost:3000, where Grafana is running locally.
In another tab, go to Webhook.site.
Copy Your unique URL.

Your webhook endpoint is now waiting for the first request.

Next, let’s configure a contact point in Grafana’s Alerting UI to send notifications to our webhook endpoint.

Return to Grafana. In Grafana’s sidebar, hover over the Alerting (bell) icon and then click Contact points.
Click + Add contact point.
In Name, write Webhook.
In Integration, choose Webhook.
In URL, paste the endpoint to your webhook endpoint.
Click Test, and then click Send test notification to send a test alert to your webhook endpoint.
Navigate back to Webhook.site. On the left side, there’s now a POST / entry. Click it to see what information Grafana sent.
A POST entry in Webhook.site
Return to Grafana and click Save contact point.

We have created a dummy Webhook endpoint and created a new Alerting contact point in Grafana. Now, we can create an alert rule and link it to this new integration.

Create an alert

Next, we’ll establish an alert rule within Grafana Alerting to notify us whenever our sample app experiences a specific volume of requests.

In Grafana, navigate to Alerting > Alert rules. Click on New alert rule.

Enter alert rule name

Make it short and descriptive as this will appear in your alert notification. For instance, database-metrics

Define query and alert condition

In this section, we define queries, expressions (used to manipulate the data), and the condition that must be met for the alert to be triggered.

Select the Prometheus data source from the drop-down menu.
In the Query editor, switch to Code mode by clicking the button at the right.
Enter the following query:
promql
```
vector(1)
```
In Prometheus, vector(1) is a special type of PromQL query that generates a constant vector. This is useful in testing and query manipulation, where you might need a constant value for calculations or comparisons. This query will allow you to create an alert rule that will be always firing.
Remove the ‘B’ Reduce expression (click the bin icon). The Reduce expression comes by default, and in this case, it is not needed since the queried data is already reduced. Note that the Threshold expression is now your Alert condition.
In the ‘C’ Threshold expression:
- Change the Input to ‘A’ to select the data source.
- Enter 0 as the threshold value. This is the value above which the alert rule should trigger.
Click Preview to run the queries.
It should return a single sample with the value 1 at the current timestamp. And, since 1 is above 0, the alert condition has been met, and the alert rule state is Firing.
A preview of a firing alert

Set evaluation behavior

An evaluation group defines when an alert rule fires, and it’s based on two settings:

Evaluation group: how frequently the alert rule is evaluated.
Evaluation interval: how long the condition must be met to start firing. This allows your data time to stabilize before triggering an alert, helping to reduce the frequency of unnecessary notifications.

To set up the evaluation:

In Folder, click + New folder and enter a name. For example: metric-alerts. This folder will contain our alerts.
In the Evaluation group, repeat the above step to create a new evaluation group. We will name it 1m-evaluation.
Choose an Evaluation interval (how often the alert will be evaluated). For example, every 1m (1 minute).
Set the pending period to, 0s (zero seconds), so the alert rule fires the moment the condition is met.

Configure labels and notifications

Choose the contact point where you want to receive your alert notifications.

Under Contact point, select Webhook from the drop-down menu.
Click Save rule and exit at the top right corner.

Trigger and resolve an alert

Now that the alert rule has been configured, you should receive alert notifications in the contact point whenever alerts trigger and get resolved.

Trigger an alert

Since the alert rule that you have created has been configured to always fire, once the evaluation interval has concluded, you should receive an alert notification in the Webhook endpoint.

The alert notification details show that the alert rule state is Firing , and it includes the value that made the rule trigger by exceeding the threshold of the alert rule condition. The notification also includes links to see the alert rule details, and another link to add a Silence to it.

Resolve an alert

To see how a resolved alert notification looks like, you can modify the current alert rule threshold.

To edit the Alert rule:

Navigate to Alerting > Alert rules.
Click on the metric-alerts folder to display the alert that you created earlier
Click the edit button on the right hand side of the screen
Increment the Threshold expression to 1.
Click Save rule and exit.

By incrementing the threshold, the condition is no longer met, and after the evaluation interval has concluded (1 minute approx.), you should receive an alert notification with status “Resolved”.

Summary

In this tutorial, you have learned how to set up a contact point, create an alert, and send alert notifications to a public Webhook. By following these steps, you’ve gained a foundational understanding of how to leverage Grafana Alerting capabilities to monitor and respond to events of interest in your data.

Feel free to experiment with different contact points to customize your alert notifications and discover the configuration that best suits your needs.

If you run into any problems, you are welcome to post questions in our Grafana Community forum.

Happy monitoring!