query.txt
// use @ingesttimestamp for weekday and hour | formatTime(format="%A", field="@ingesttimestamp", as="weekday") | formatTime(format="%k", field="@ingesttimestamp", as="hour") // set notification day
Use the event ingestion timestamp to limit query results to a defined notification window. Configure the allowed weekdays and hours to ensure alerts run only during the intended period, such as business hours. To alert outside that window instead, invert the in() and test() conditions.
LogScaleDetection & MonitoringDetectionInvestigation
@sebastian · 20.8.2026
