Skip to main content
A trigger runs work. An alert watches and tells you. Both are configured per namespace and both can end in a Slack message, which is why they get confused.

Which one do I want

The short test: if the outcome is work that happened, you want a trigger. If the outcome is someone finding out, you want an alert.

Triggers

A trigger is a schedule plus an action.
cURL
A trigger’s output is its run history. Read it to see what ran and what failed.

Alerts

An alert is a source plus a condition plus somewhere to send the news. notification_config.channels takes one or more of webhook, slack, and email.
cURL

The seam worth knowing about

execution_mode takes on_ingest, scheduled, or on_demand.
scheduled does not run today. The name implies a trigger drives the alert on a schedule, and no trigger action executes an alert. An alert set to scheduled is accepted and never fires.Use on_ingest, which evaluates the alert as data arrives, or on_demand and call it yourself.
on_ingest is what most alerts want. It rides the ingestion pipeline, so the alert is evaluated against data at the moment that data lands.

Webhooks

Where an alert’s webhook channel delivers.

Change feed

Reading what changed, rather than being told.