:_mod-docs-content-type: ASSEMBLY
[id="custom-logging-alerts"]
include::_attributes/common-attributes.adoc[]
= Custom logging alerts
:context: custom-logging-alerts

toc::[]

In logging 5.7 and later versions, users can configure the LokiStack deployment to produce customized alerts and recorded metrics. If you want to use customized link:https://grafana.com/docs/loki/latest/alert/[alerting and recording rules], you must enable the LokiStack ruler component.

LokiStack log-based alerts and recorded metrics are triggered by providing link:https://grafana.com/docs/loki/latest/query/[LogQL] expressions to the ruler component. The {loki-op} manages a ruler that is optimized for the selected LokiStack size, which can be `1x.extra-small`, `1x.small`, or `1x.medium`.

To provide these expressions, you must create an `AlertingRule` custom resource (CR) containing Prometheus-compatible link:https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/[alerting rules], or a `RecordingRule` CR containing Prometheus-compatible link:https://prometheus.io/docs/prometheus/latest/configuration/recording_rules/[recording rules].

Administrators can configure log-based alerts or recorded metrics for `application`, `audit`, or `infrastructure` tenants. Users without administrator permissions can configure log-based alerts or recorded metrics for `application` tenants of the applications that they have access to.

Application, audit, and infrastructure alerts are sent by default to the {product-title} monitoring stack Alertmanager in the `openshift-monitoring` namespace, unless you have disabled the local Alertmanager instance. If the Alertmanager that is used to monitor user-defined projects in the `openshift-user-workload-monitoring` namespace is enabled, application alerts are sent to the Alertmanager in this namespace by default.

include::modules/configuring-logging-loki-ruler.adoc[leveloffset=+1]
include::modules/loki-rbac-rules-permissions.adoc[leveloffset=+1]

ifdef::openshift-enterprise[]
[role="_additional-resources"]
.Additional resources
* xref:../../../authentication/using-rbac.adoc#using-rbac[Using RBAC to define and apply permissions]
endif::openshift-enterprise[]

include::modules/logging-enabling-loki-alerts.adoc[leveloffset=+1]

[role="_additional-resources"]
[id="additional-resources_custom-logging-alerts"]
== Additional resources
* link:https://docs.redhat.com/en/documentation/monitoring_stack_for_red_hat_openshift/latest/html/about_monitoring/about-ocp-monitoring[About {product-title} monitoring]
ifdef::openshift-enterprise[]
* xref:../../../post_installation_configuration/configuring-alert-notifications.adoc#configuring-alert-notifications[Configuring alert notifications]
endif::openshift-enterprise[]
// maybe need an update to https://docs.openshift.com/container-platform/4.13/observability/monitoring/monitoring-overview.html#default-monitoring-targets_monitoring-overview to talk about Loki and Vector now? Are these part of default monitoring?
