cx-alerts

Q: How do I install cx-alerts?

Run npx skills add https://github.com/coralogix/cx-cli --skill cx-alerts in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/cx-alerts/ (personal) or .claude/skills/cx-alerts/ (project).

by coralogix

This skill should be used when the user asks to "manage alerts", "create alert", "list alerts", "delete alert", "check alert status", "enable alert", "disable alert", "investigate firing alerts", "check which alerts are active", "find alerting rules", "set up an alert", "configure alerting", "mute an alert", "silence an alert", "see alert definitions", "check alert priority", or wants to manage Coralogix alert definitions using the cx CLI.

Installs: 3.6K
Last 24h: +78
Trending rank: #2348
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/coralogix/cx-cli --skill cx-alerts

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads cx-alerts automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Alert Management Skill

Use this skill to list, inspect, create, delete, enable, and disable Coralogix alert definitions using the cx alerts CLI commands.

CLI Commands

Command	Purpose	Key flags
`cx alerts list`	List all alert definitions	`--name <filter>`
`cx alerts get <id>`	Get a single alert definition by ID	-
`cx alerts create`	Create an alert from a JSON definition	`--from-file <path>` (default: stdin)
`cx alerts delete <id>`	Delete an alert	-
`cx alerts enable <id>`	Enable an alert	-
`cx alerts disable <id>`	Disable an alert	-
`cx alerts events`	List events; use alert-version scoped endpoint when filtering	`--alert-version-id`, `--start`, `--end`
`cx alerts event-stats`	Get alert event statistics	-
`cx alerts suppression-rules list`	List suppression rules	-
`cx alerts suppression-rules get <id>`	Get a suppression rule	-
`cx alerts suppression-rules create`	Create a suppression rule	`--from-file <path>`
`cx alerts suppression-rules update`	Update a suppression rule	`--from-file <path>`
`cx alerts suppression-rules delete <id>`	Delete a suppression rule	-

Output format: append -o json or -o toon to list, get, and create commands for machine-readable output.

Multi-profile: use -p <profile> (repeatable) to target multiple profiles simultaneously.

Alert Types Reference

Coralogix supports 12 alert types:

Type enum	Human name	Description
`ALERT_DEF_TYPE_LOGS_IMMEDIATE`	Logs Immediate	Trigger on every matching log entry
`ALERT_DEF_TYPE_LOGS_THRESHOLD`	Logs Threshold	Trigger when log count exceeds a threshold in a time window
`ALERT_DEF_TYPE_LOGS_ANOMALY`	Logs Anomaly	ML-based anomaly detection on log volume
`ALERT_DEF_TYPE_LOGS_RATIO_THRESHOLD`	Logs Ratio Threshold	Trigger on ratio between two log queries
`ALERT_DEF_TYPE_LOGS_NEW_VALUE`	Logs New Value	Trigger when a new value appears in a field
`ALERT_DEF_TYPE_LOGS_UNIQUE_COUNT`	Logs Unique Count	Trigger on unique value count threshold
`ALERT_DEF_TYPE_LOGS_TIME_RELATIVE_THRESHOLD`	Logs Time Relative	Compare current vs past time window
`ALERT_DEF_TYPE_METRIC_THRESHOLD`	Metric Threshold	Trigger when a PromQL expression crosses a threshold
`ALERT_DEF_TYPE_METRIC_ANOMALY`	Metric Anomaly	ML-based anomaly detection on metrics
`ALERT_DEF_TYPE_TRACING_IMMEDIATE`	Tracing Immediate	Trigger on every matching span
`ALERT_DEF_TYPE_TRACING_THRESHOLD`	Tracing Threshold	Trigger when span count exceeds a threshold
`ALERT_DEF_TYPE_FLOW`	Flow	Sequence-based alert combining multiple conditions

Priority Levels

Always ask the user what priority to use when creating alerts:

Priority	Use case
P1	Critical - pages on-call immediately
P2	High - needs attention within the hour
P3	Medium - investigate during business hours
P4	Low - informational, check when convenient
P5	Info - logging/tracking only

Create Workflow

Ask the user what they want to alert on (logs, metrics, traces)
Ask for priority (P1–P5)
Build the JSON payload with alertDefProperties - use the API wire format (see references/alert-schemas.md for all enum values)
Tip: use cx alerts get <existing-id> -o json to get a working template, modify it, and pipe into create
Create using: echo '<json>' | cx alerts create or cx alerts create --from-file alert.json
Verify with cx alerts list --name "<alert name>"

Important structural note: The type field is a string enum (e.g. "ALERT_DEF_TYPE_LOGS_THRESHOLD"), and the alert type config (e.g. "logsThreshold": {...}) is a sibling field at the same level - NOT nested inside type.

Example: Logs Threshold Alert

{
  "alertDefProperties": {
    "name": "High Error Rate",
    "description": "Alert when error logs exceed threshold",
    "priority": "ALERT_DEF_PRIORITY_P2",
    "type": "ALERT_DEF_TYPE_LOGS_THRESHOLD",
    "enabled": true,
    "logsThreshold": {
      "logsFilter": {
        "simpleFilter": {
          "luceneQuery": "severity:ERROR",
          "labelFilters": {
            "applicationName": [
              { "operation": "LOG_FILTER_OPERATION_TYPE_IS_OR_UNSPECIFIED", "value": "my-app" }
            ]
          }
        }
      },
      "rules": [{
        "condition": {
          "conditionType": "LOGS_THRESHOLD_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",
          "threshold": 100,
          "timeWindow": {
            "logsTimeWindowSpecificValue": "LOGS_TIME_WINDOW_VALUE_MINUTES_5_OR_UNSPECIFIED"
          }
        }
      }]
    }
  }
}

Example: Metric Threshold Alert

{
  "alertDefProperties": {
    "name": "CPU Usage Critical",
    "priority": "ALERT_DEF_PRIORITY_P1",
    "type": "ALERT_DEF_TYPE_METRIC_THRESHOLD",
    "enabled": true,
    "metricThreshold": {
      "metricFilter": { "promql": "avg(cpu_usage_percent)" },
      "rules": [{
        "condition": {
          "conditionType": "METRIC_THRESHOLD_CONDITION_TYPE_MORE_THAN_OR_UNSPECIFIED",
          "threshold": 90,
          "ofTheLast": { "dynamicDuration": "5m" },
          "forOverPct": 100
        }
      }]
    }
  }
}

Example: Logs Immediate Alert

{
  "alertDefProperties": {
    "name": "OOM Killer Detected",
    "description": "Alert immediately when OOM killer runs",
    "priority": "ALERT_DEF_PRIORITY_P1",
    "type": "ALERT_DEF_TYPE_LOGS_IMMEDIATE_OR_UNSPECIFIED",
    "enabled": true,
    "logsImmediate": {
      "logsFilter": {
        "simpleFilter": {
          "luceneQuery": "\"Out of memory\" OR \"OOM\"",
          "labelFilters": {}
        }
      }
    }
  }
}

Investigation Workflow

Find firing alerts

# List all alerts and look for ALERTING status
cx alerts list -o json | jq '.[] | select(.status == "ALERTING")'

# Filter by name
cx alerts list --name "error"

Inspect a specific alert

cx alerts get <alert-id>
cx alerts get <alert-id> -o json

Disable a noisy alert (temporary mute)

cx alerts disable <alert-id>
# Later, re-enable:
cx alerts enable <alert-id>

Suppression Rules

Manage alert suppression rules that mute alerts during maintenance windows or known noisy periods.

Command	Purpose
`cx alerts suppression-rules list`	List all suppression rules
`cx alerts suppression-rules get <id>`	Get a suppression rule by ID
`cx alerts suppression-rules create --from-file`	Create a suppression rule
`cx alerts suppression-rules update --from-file`	Update a suppression rule
`cx alerts suppression-rules delete <id>`	Delete a suppression rule

A rule has two IDs: unique_identifier is its stable, addressable ID (use it for get/update/delete), while id is the rule version ID that changes on every update.

Request body shape

create and update take the rule wrapped in an alertSchedulerRule object.

{
  "alertSchedulerRule": {
    "uniqueIdentifier": "<rule-id>",
    "name": "maintenance-window",
    "filter": { "whatExpression": "source logs | filter true", "alertUniqueIds": { "value": [] } },
    "schedule": {
      "scheduleOperation": "SCHEDULE_OPERATION_MUTE",
      "oneTime": { "timeframe": { "startTime": "2026-08-10T19:30:00", "endTime": "2026-08-10T20:30:00", "timezone": "UTC" } }
    }
  }
}

# List suppression rules - the ID column is the unique_identifier
cx alerts suppression-rules list -o json

# Inspect one rule
cx alerts suppression-rules get <unique-identifier> -o json

# Create from a definition file (must use the alertSchedulerRule wrapper)
cx alerts suppression-rules create --from-file suppression-rule.json

# Delete
cx alerts suppression-rules delete <unique-identifier> --yes

Key Principles

Always ask for priority (P1–P5) when creating alerts - never assume
Use --name filter for large accounts with many alerts
Use -o json with jq for filtering and transformation
Use --from-file - to pipe JSON from stdin when constructing alerts programmatically
Verify after create - always list or get the alert after creation to confirm
Disable, don't delete - prefer disabling alerts over deletion for auditability
Link to a specific alert - cx alerts list prints only one "View in Coralogix" link, to the alerts overview page, not a per-alert link. To link a user to one specific alert, build <base>/alerts/<alert_id>, where <base> is the console URL already seen in a `View in Coralogix: <base>/...` line printed by any `cx alerts` command this session - never fabricate `<base>` yourself.

Additional Resources

Reference Files

references/alert-schemas.md - Complete JSON schema reference for all 12 alert types: field names, enum values (condition types, time windows, filter operations), common sub-objects (logs filter, tracing filter, notification groups, activity schedules), and important gotchas
references/dataprime-reference.md - DataPrime query language reference for log-based and span-based alert conditions (filter syntax, operators, severity values)
references/logs-querying.md - Log data model, field discovery, and query patterns for building log alert conditions
references/promql-guidelines.md - PromQL reference for metric-based alert conditions (counters, gauges, histograms, threshold patterns)
references/spans-querying.md - Span data model, duration units, and query patterns for building tracing alert conditions

Related Skills

cx-cases - triage the cases that group alert events into investigations
cx-slos - the SLO definitions whose error-budget burn raises alerts
cx-observability-setup - setting up notification routing and webhook integrations for alerts
cx-telemetry-querying - investigate the telemetry behind a firing alert

FAQ

What does the cx-alerts skill do?

How do I install cx-alerts?

Run npx skills add https://github.com/coralogix/cx-cli --skill cx-alerts in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/cx-alerts/ (personal) or .claude/skills/cx-alerts/ (project).

Which AI agents can use cx-alerts?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is cx-alerts safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains cx-alerts?

It is published by coralogix in coralogix/cx-cli. It has 3,636 recorded installs.

More from coralogix/cx-cli

View all →

cx-telemetry-querying

coralogix/cx-cli

Use this skill for any question involving telemetry data: "investigate an issue", "debug a problem", "find out why something is slow", "check error rates", "analyze user behavior", "understand a production incident", "query telemetry data", "look at logs", "search logs", "find errors", "find stack traces", "filter by severity", "check traces", "examine spans", "investigate request latency", "debug service-to-service calls", "look up a trace ID", "analyze RUM data", "query rum.events", "check frontend performance", "frontend errors", "Core Web Vitals", "JavaScript exceptions", "query metrics", "check CPU usage", "run a PromQL query", "check error rate", "look up a metric", "check memory usage", "how do I write a DataPrime query", "DataPrime syntax", or wants to answer questions using observability data from logs, metrics, traces, RUM, or APM.

Code Quality & Workflow4.8K installs

cx-search-dashboard

coralogix/cx-cli

This skill should be used when the user asks to "find a dashboard", "search dashboards", "does a dashboard exist for X", "find widgets that query Y", "which dashboards use this field", "find a dashboard about errors", "look up dashboards by description", "search for existing monitoring dashboards", "find widgets that reference a field", or wants to discover existing Coralogix dashboards or widgets using natural-language or field-based search.

Data & Databases3.9K installs

coralogix-docs

coralogix/cx-cli

Search and read official Coralogix platform documentation using cx docs search and cx docs fetch. Use when the user asks how Coralogix features work, how to configure or use the UI, set up integrations (OpenTelemetry, agents, collectors, webhooks), manage API keys, explore spans/traces/logs in the product, configure alerts/SLOs/dashboards, or needs authoritative product docs — not live tenant telemetry.

Docs & Writing3.8K installs

cx-cli

coralogix/cx-cli

This skill should be used whenever the user runs any cx command, uses the cx CLI, Coralogix CLI, or mentions cx in the context of Coralogix observability. This skill provides cross-cutting concerns like update notifications that apply to all cx commands.

DevOps & Cloud3.6K installs

cx-observability-setup

coralogix/cx-cli

Use this skill when the user asks to "set up monitoring", "configure observability", "onboard new service", "create saved view", "set up notifications", "configure webhook", "set up Slack integration", "outgoing webhook", "automation action", "webhook for alerts", "create view", "saved view", "view folder", "organize dashboards", "install integration", "configure extension", "contextual data", "connect external service", "create notification connector", "set up email alerts", "configure PagerDuty", "notification routing", "deploy extension", "test webhook", "notification preset", "test notification", "webhook actions", or wants to set up, configure, or manage the observability stack for a service or team.

DevOps & Cloud3.5K installs

cx-data-pipeline

coralogix/cx-cli

Use this skill when the user asks to "set up parsing", "create parsing rule", "extract fields from logs", "regex extraction", "log parsing", "enrich logs", "add context to logs", "custom enrichment table", "lookup table", "geo enrichment", "create metric from logs", "events to metrics", "convert logs to metrics", "generate metrics from events", "recording rule", "precomputed metrics", "PromQL recording", "configure data pipeline", "transform log data", "data processing rules", "rule group", "enrichment settings", "E2M definition", "labels cardinality", "bulk delete rules", "enrichment limits", "search enrichment table", "what should I convert to metrics", "E2M not producing metrics", "E2M no series", "reduce log cost with E2M", "logs to metrics aggregation", "spans to metrics", or wants to configure how Coralogix processes, enriches, or transforms ingested data.

Data & Databases3.4K installs

Popular other skills

View category →

hyperframes-cli

heygen-com/hyperframes

The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from build or render failures.

1.3M installs

triage

mattpocock/skills

Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.

1M installs

ask-matt

mattpocock/skills

Ask which skill or flow fits your situation. A router over the skills in this repo.

778.4K installs

to-questionnaire

mattpocock/skills

Turn a decision you can't fully answer into a questionnaire for someone else to fill in.

508.9K installs

wait-what

mattpocock/skills

Stop. That last message did not land: re-pitch it.

459.7K installs

loop-me

mattpocock/skills

Grill me about specs for the workflows I want to build, within this workspace.

447.9K installs

cx-alerts

Install

Install

Describe the task

Review the result

SKILL.md

Alert Management Skill

CLI Commands

Alert Types Reference

Priority Levels

Create Workflow

Example: Logs Threshold Alert

Example: Metric Threshold Alert

Example: Logs Immediate Alert

Investigation Workflow

Find firing alerts

Inspect a specific alert

Disable a noisy alert (temporary mute)

Suppression Rules

Request body shape

Key Principles

Additional Resources

Reference Files

Related Skills

FAQ

More from coralogix/cx-cli

Popular other skills