Error while writing an alert rule in alert.yml file

[Isabel Noronha]

 This is just code snippet of my alerts.yml file

- alert: ContainerKilled

    expr: IF absent(((time() - container_last_seen{name=".+"}) < 5))

    for: 15s

    labels:

      severity: warning

    annotations:

      summary: "Container killed (instance {{ $labels.instance }})"

      description: "A container has been killed\n  VALUE = {{ $value }}\n  LABELS: {{ $labels }}"

Could anyone tell me what am I doing wrong in this rule?

It's throwing error :parse error: unexpected identifier \"absent\""

[Christian Hoffmann]

Hi,

The "IF" doesn't belong there. Try removing it. :)

Kind regards,
Christian

[Isabel Noronha]

Thanks that worked.
So absent can be used only when a job is known (eg. job=" Jenkins") or can it be used generically with any kind of label?

So my requirement is to send an alert when a container goes down.
So I create a service that has a minimum of  1k container. So I cannot hardcode the container names.
Is there a way to get alerts when a container is down for sure?
I have already used container_last_seen but it is not so accurate.

Any help would be appreciated.

Thanks,

Regards,

Isabel