AlertRule Spec

An AlertRule is a resource with three top-level keys. Everr validates it on everr apply and again on read. The spec holds a ClickHouse query whose every returned row is a firing instance, plus the notification text to send when instances start and stop firing.

kind: AlertRule
metadata:
  name: <slug>
spec:
  { ... }

spec

Message templating

notificationMessage.title and notificationMessage.description support ${column} placeholders. Each placeholder is replaced with that firing instance's value for the named column, so one query produces one tailored message per instance.

Every referenced name must be a column the query returns; this is validated on apply. A missing or null value renders as empty text. The query SQL itself does not support templating, placeholders work only in the notification message fields.

Manifest

The apply directory — by convention an everr/ directory at your repo root — needs an everr.yaml (or everr.yml) file at its root with exactly one key:

# everr/everr.yaml
repoid: "2f8e3f90-9d1c-5d5f-a0f9-2d8e7f4a25d1"

Declarations sit flat in everr/, named by kind: *.alert.yaml, *.dashboard.yaml, *.runbook.yaml (the legacy *.notebook.yaml suffix is still recognized). everr apply ./everr discovers every kind: Dashboard, kind: AlertRule, and kind: Runbook document under the directory and makes the live resources for that repoid exactly match the tree: new documents are created, changed ones updated, and removed ones deleted. The kind suffix is a naming convention only — apply routes by the kind: field. Use --preview to stage the changes for review without touching the live state (preview rules evaluate but never notify). See the everr apply reference.

Constraints and errors

• evaluationInterval must be ≥ 1m.
• notificationMessage.title is required and non-empty.
• ${column} must reference a column the query returns.
• instanceLabels needs ≥1 entry when present.
• query rejects ${...}.
• Supported document kinds for apply are Dashboard and AlertRule.