Support “Percent of Sessions Affected” as a Filter or Allow Nested Condition Logic in Alert Rules
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 21h 10m
- Merged PRs (30d)
- 635
Description
### Problem Statement
I’d like to request an enhancement to the alert rule system to support more flexible logic when combining conditions and filters, specifically regarding the “percent of sessions affected” (EventFrequencyPercentCondition).
Current Limitation:
- The EventFrequencyPercentCondition is only available as a condition, not as a filter.
- If I want to trigger an alert when any of several conditions are true (using actionMatch = "any"), but only if a certain percentage of sessions are affected, there is no way to express this in a single rule.
- The only workaround is to create multiple alert rules, each with actionMatch = "all" and both the percent condition and one of the “any” conditions, which leads to duplication and maintenance overhead.
Example Use Case:
> I want to alert if (A or B or C) is true, but only if X% of sessions in an interval are affected.
Currently, this requires creating three separate rules:
- (A and percent condition)
- (B and percent condition)
- (C and percent condition)
Feature Request:
- Allow the “percent of sessions affected” logic to be used as a filter as well as a condition, OR
- Support more complex/nested logic in alert rules, such as “(A or B or C) and D” within a single rule.
Benefits:
- Reduces duplication of alert rules.
- Makes alerting logic more expressive and maintainable.
- Aligns with how users expect to combine conditions and filters.
### Solution Brainstorm
_No response_
### Product Area
Alerts
Contributor guide
Research direction
Start by tracing how alert rules represent EventFrequencyPercentCondition, filters, and actionMatch logic in the Alerts product area. Compare the requested filter support with nested condition logic, then define and test one supported form that expresses “(A or B or C) and D” without duplicated rules.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- observability
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100