From 7ae8ea317d3c181ed059ea0b692b6aea1b7dbf3e Mon Sep 17 00:00:00 2001 From: Hector Huertas Date: Thu, 17 Oct 2024 16:36:39 +0200 Subject: [PATCH] Exclude more low volume sources --- common/logging.yaml.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common/logging.yaml.tmpl b/common/logging.yaml.tmpl index 8752704..f853c41 100644 --- a/common/logging.yaml.tmpl +++ b/common/logging.yaml.tmpl @@ -96,7 +96,7 @@ groups: # Main alert, intended for "high rate" inputs # kubernetes_logs cardinality is huge and is causing this alert to fail - alert: VectorFailingToInput2h - expr: sum by (component_id) (rate(vector_component_received_events_total{component_kind="source",component_id!~"kubernetes_events|s3_msk|kubernetes_logs"}[5m])) == 0 + expr: sum by (component_id) (rate(vector_component_received_events_total{component_kind="source",component_id!~"kubernetes_logs|kubernetes_events|s3_msk|uw_link_firewall_events|careers_uw_co_uk_firewall_events|myaccount_uw_co_uk_firewall_events|uw_partners_firewall_events"}[5m])) == 0 for: 2h labels: team: infra