Use log filters to specify which logs you want to be notified about

Logalert gives you alerts based on specific keywords in your Vercel logs. When users encounter errors, you can get notified via email and fix issues faster.

Vercel logs have a defined structure. When you are setting up or editing your alert, you can choose how the alert will filter for log entries based on matches in specific fields the log entries.

Our recommended error filter

(This feature launched 2021-07-26.)

For the vast majority of users, the default recommended filter will work well to notify you of errors, so you don't need to change them. Our default recommended filter looks for the substring "error" in your log message as well as the substring "timed out":

Screenshot 2021-07-26 at 22.36.14.png

This captures any log messages that contain the substring "error" in a case-insensitive substring match. For example, this will match logs with messages that contain the word "ERROR" or "TokenExpiredError".

It also captures logs produced by serverless functions that time out when they reach the limit set by Vercel:

The maximum execution timeout is 10 seconds when deployed on a Personal Account (Hobby plan). For Teams, the execution timeout is 60 seconds (Pro plan) or 900 seconds (Enterprise plan).

For 99% of users, the default filters will work well to notify you of errors, so you don't need to change them. If you'd like to change your alert filters, here's a quick guide to composing your own filter query:

Adding filters and filter groups

You can add a filter row by clicking "+filter" this allows you to add an additional term like "warning":

Screenshot 2021-07-26 at 22.54.03.png

You can also add filter groups for more complex queries. For instance, if you want to exclude a set of keywords, like so:

Screenshot 2021-07-26 at 22.55.59.png

To duplicate or remove a filter row or group, simply click on the three dots next to it.

All clauses in a filter group is joined by either AND or OR so you can configure whether you want the log to satisfy at least one condition or all conditions specified. Since we do not currently support AND NOT, you will have to specify the NOT within each filter clause using "does not contain" or "is not".

For example, if you wanted the following:

(message contains "error") AND NOT (message contains "ignore" OR message contains "notError");

You should instead re-phrase it like this:

(message contains "error") AND (message does not contain "ignore" AND message does not contain "notError")

Filter fields

The vast majority of filters should use the message filter field. The message field contains the outputs to stdout (console.log) or stderr (console.error). All lines printed from stdout (console.log) or stderr (console.error) for each request are condensed into a single log entry message. You can learn more about the message field here.

There are additional fields that we support filtering on:

proxy.statusCode

proxy.statusCode is the status code of the HTTP request received by the end user. For example, 200 is a normal "OK" response status code, and 500 is an internal server error. We do a direct comparison of codes, so the options are "is" and "is not":

Screenshot 2021-07-26 at 23.08.10.png

A common use case for this field is to filter for logs that are not 200 or 304 (redirect):

Screenshot 2021-07-26 at 23.09.11.png

However, these events will most likely emit a "error" log message, so you should consider looking for the substring "error" in the message field rather than using proxy.statusCode field.

proxy.method & proxy.path

proxy.path is the path of the HTTP request from the end user. For example, "/api/item/edit/abcdef" or "/".

proxy.method is the HTTP method of the request from the end user. For example, GET, POST, PUT, etc.

For example, if you've just launched a client facing API and you want to see if your customers are using the API, you can create an alert when the new API is used:

Screenshot 2021-07-26 at 23.12.54.png

proxy.source

You can learn more about each of the 4 log sources in our guide to the anatomy of a Vercel log. The vast majority of filters will not need to specify a log source because Logalert monitors all 4 sources.

We recommend you only use this field to filter out logs from static or external sources:

Screenshot 2021-07-26 at 23.15.35.png

To learn more about each of these fields, please refer to our guide to the anatomy of a Vercel log.

Once you create an alert, you can always change the filter later.

If you have any questions please contact us at support@logalert.app or leave us a message in the feedback form inside the app.