How to add java error log count alerting rule for 9.4.0

[liuvlun]

I implemented the lal and mal and the log metric also can be displayed in widget, but when i add the error count alerting rule, it always failed and cant trigger the condition.
So please see the following detail and help to check which place is not correct. thank you.
The lal file as below and it works:
`rules:

• name: log_count
  layer: GENERAL
  dsl: |
  filter {
  text {
  abortOnFailure true
  regexp "(?\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}) \[TID:(?.+?)] \[(?.+?)] (?\w{4,})"
  }
  extractor {
  metrics {
  timestamp log.timestamp as Long
  labels level: parsed.level, service: log.service, instance: log.serviceInstance
  name "log_count"
  value 1
  }
  }
  sink {
  if (parsed.level == "INFO") {
  enforcer { }
  }
  if (parsed.level == "ERROR") {
  enforcer { }
  }
  if (parsed.level == "WARN") {
  enforcer { }
  }
  }
  }`

The mal file as below and it works
`expSuffix: instance(['service'], ['instance'], Layer.GENERAL)
metricPrefix: log
metricsRules:

• name: count_info
  exp: log_count.tagEqual('level', 'INFO').sum(['service', 'instance']).downsampling(SUM)
• name: count_warn
  exp: log_count.tagEqual('level', 'WARN').sum(['service', 'instance']).downsampling(SUM)
• name: count_error
  exp: log_count.tagEqual('level', 'ERROR').sum(['service', 'instance']).downsampling(SUM)
• name: count_error_rate
  exp: log_count.tagEqual('level', 'ERROR').sum(['service', 'instance']).downsampling(SUM).increase('PT1M')`

The alerting rule segment as below but it not works:
log_count_error_rule: metrics-name: log_count_error #expression: sum(log_count_error) op: ">" threshold: 1 #period: 1 tags: level: WARNING #count: 2 #silence-period: 5 message: The error logs are more than 5 in latest ten minutes, please have a look

The metric graph in service instance as below:

Please help to check what`s the problem, thank you again.

[wu-sheng]

9.4 is too old, some old versions don't support MAL metrics for alerting.

I believe the 10.0.1 works for that, and the alerting kernel has been upgraded to use MQE.

[liuvlun]

The same version in my window OS is ok, do you think if it is the permission issue of centos?

[wu-sheng]

I don't use CentOS. Sorry.

[liuvlun]

I will run this version in unbuntu and check it.

[liuvlun]

I run V10.0.0 + BanyanDB in centos normal, but found the BanyanDB database run not stable and it stop after running 3hours.
Three questions:

1. How to run BanyanDB in daemon?
2. Why BanyanDB log dont have the timestamp in the log?
3. Why are logs sorted in positive order and how to change the log sort to reverse order

[wu-sheng]

BanyanDB is new, you could run elasticsearch if you don't want to dig deeper about codes.

Using BanyanDB at current stage, we recommend you having code reading capabilities.