Alert expression variables

An alert rule’s expression is expr-lang evaluated against one service’s rollup for the current window. These are the values it can read — the names below are exactly what the evaluator binds, because both this page and the evaluator come from the same struct.

Variable	Type	Means
error_rate	number	Errors as a proportion of requests over the evaluation window, from 0 to 1.
error_rate_delta	number	Change in error rate against the baseline, as a proportion.
health_score	number	A composite 0-100 score combining errors, latency and traffic. Convenient for a single catch-all rule; too coarse to explain why it moved.
log_count	number	Log records recorded for the service over the window.
p50	number	Median request latency in milliseconds.
p95	number	95th-percentile request latency in milliseconds. The usual latency signal: it moves when a meaningful share of requests slow down, where the median does not.
p95_delta	number	Change in p95 latency against the baseline, in milliseconds.
service	string	The service name being evaluated, as a string. Compare it when one rule needs to behave differently for one service.
throughput	number	Requests per second. Worth pairing with any rate threshold — a service handling two requests a minute reaches a 50% error rate on one failure.
throughput_delta	number	Change in throughput against the baseline, in requests per second. Negative when traffic drops, which is how a rule catches a service that has stopped receiving requests rather than started failing them.
z_score	number	How far the service’s current behaviour sits from its own recent baseline, in standard deviations. Use it to catch a service that has changed without committing to an absolute threshold that fits every service.

See Set up alerts for the rule model these sit in, including the pending/firing/resolved lifecycle and webhook delivery.