provider logs POST /api/projects/{project_id}/logs/alerts/
@utdk/posthog /api/projects/{project_id}/logs/alerts/
logs_alerts_create
project_id path required
Project ID of the project you're trying to access. To find the ID of the project, make a call to /api/projects/.
string

Try it

Authentication
Configure credentials for PostHog API
logsAlertsCreate
POST/api/projects/{project_id}/logs/alerts/

Parameters

required

Project ID of the project you're trying to access. To find the ID of the project, make a call to /api/projects/.

Input

required

Unique identifier for this alert.

Human-readable name for this alert. Defaults to 'Untitled alert' on create when omitted.

Whether the alert is actively being evaluated. Disabling resets the state to not_firing.

Filter criteria — subset of LogsViewerFilters. Must contain at least one of: severityLevels (list of severity strings), serviceNames (list of service name strings), or filterGroup (property filter group object). May be empty on draft alerts (enabled=false).

Number of matching log entries that constitutes a threshold breach within the evaluation window. Defaults to 100. Use 0 with the 'above' operator to fire on any matching log.

Whether the alert fires when the count is above or below the threshold. * `above` - Above * `below` - Below

Time window in minutes over which log entries are counted. Allowed values: 5, 10, 15, 30, 60.

required

How often the alert is evaluated, in minutes. Server-managed.

required

Current alert state: not_firing, firing, pending_resolve, errored, or snoozed. Server-managed. * `not_firing` - Not firing * `firing` - Firing * `pending_resolve` - Pending resolve * `errored` - Errored * `snoozed` - Snoozed * `broken` - Broken

Total number of check periods in the sliding evaluation window for firing (M in N-of-M).

How many periods within the evaluation window must breach the threshold to fire (N in N-of-M).

Minimum minutes between repeated notifications after the alert fires. 0 means no cooldown.

ISO 8601 timestamp until which the alert is snoozed. Set to null to unsnooze.

required

When the next evaluation is scheduled. Server-managed.

required

When the last notification was sent. Server-managed.

required

When the alert was last evaluated. Server-managed.

required

Number of consecutive evaluation failures. Resets on success. Server-managed.

required

Error message from the most recent errored check, or null if the alert's most recent check was successful. Sourced from LogsAlertEvent without denormalization so retention-aware cleanup rules stay the only source of truth.

required

Continuous state intervals over the last 24h, ordered oldest-first. Each interval covers a span during which (state, enabled) was constant. Derived from LogsAlertEvent rows walked in chronological order; consecutive identical intervals are collapsed. Drives the 'Last 24h' status bar on the alert list.

required

Notification destination types configured for this alert — e.g. 'slack', 'webhook'. Empty list means no notifications will fire. One or more destinations should be added after creating an alert.

required

When the alert was first enabled. Null means the alert is still in draft state.

required

When the alert was created.

required
required

When the alert was last modified.

Configure credentials above to enable sending.

Code snippet
Updates live as you fill in the form above.

TypeScript

import posthog from '@utdk/posthog';

await posthog.logsAlertsCreate({
  "enabled": true,
  "threshold_count": 100,
  "threshold_operator": "above",
  "window_minutes": 5,
  "evaluation_periods": 1,
  "datapoints_to_alarm": 1,
  "cooldown_minutes": 0
})