Manage incidents for SQL-based alerting policies Stay organized with collections Save and categorize content based on your preferences.

Google Cloud console

To list the incidents in your Google Cloud project, do the following:

1. In the Google Cloud console, go to the notifications Alerting page:

   Go to Alerting

   If you use the search bar to find this page, then select the result whose subheading is Monitoring.

2. In the toolbar of the Google Cloud console, select your Google Cloud project. For App Hub configurations, select the App Hub host project or management project.

   The Alerting page displays information about your alerting policies, snoozes, and incidents:

   • The Summary pane lists the number of open incidents.
   • The Incidents table displays the most recent open incidents. To list the most recent incidents in the table, including those that are closed, click Show closed incidents.

3. To view the details of a specific incident, select the incident in the list.

   The Incident details page opens. For more information about the Incident details page, see the Investigate an incident section of this document.

Find older incidents

The Incidents table on the Alerting page shows the most recent open incidents. To view older incidents, do one of the following:

• To page through the entries in the Incidents table, click arrow_back_ios Newer or arrow_forward_ios Older.

• To open a page that lets you list and filter your incidents, click See all incidents. The Incidents page opens. From that page, do the following:

  • Show all incidents, including closed incidents. To show all incidents, click Show closed incidents.
  • Filter incidents. For information about adding filters, see Filter incidents.
  • Acknowledge or close an incident, or snooze its alerting policy. To access these options, click more_vert More options in the incident's row, and make a selection from the menu. For more information, see Manage incidents.

Filter incidents

To restrict the incidents that the table shows, add filters. If you add multiple filters, the table displays only incidents that satisfy all the filters.

To filter the table of incidents, do the following:

1. On the Incidents page, click filter_list Filter table and then select a filter property. Filter properties include the following:

   • State of the incident
   • Name of the alerting policy
   • When the incident was opened or closed

2. Select a value from the secondary menu or enter a value in the filter bar.

   The Incidents table then lists the filter.

gcloud

You can use the gcloud to get incidents and list incidents.

Get incident

Before using any of the command data below, make the following replacements:

• ALERT_NAME: The resource name of the alert. For example, projects/my-project/alerts/my-alert-id.

Execute the gcloud alpha monitoring alerts describe command:

Linux, macOS, or Cloud Shell

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha monitoring alerts describe ALERT_NAME

Windows (PowerShell)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha monitoring alerts describe ALERT_NAME

Windows (cmd.exe)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha monitoring alerts describe ALERT_NAME

The command returns a response with alert details such as alert state, attached labels, and the source alerting policy. Note that the labels in the response are subject to change while this feature is in preview. The response looks similar to the following:

{
  "name": "projects/my-project/alerts/my-alert-id",
  "state": "OPEN",
  "open_time": "2025-06-11T09:53:46Z",
  "resource": {
    "type": "sql_alert"
  },
  "policy": {
    "name": "projects/my-project/alertPolicies/POLICY_1",
    "displayName": "test-policy"
  },
  "summaryText": "The row count SQL Condition for \"test-policy\" is above the threshold of 1."
}

List incidents

You can list incidents in your project and filter the results using the gcloud CLI.

Before using any of the command data below, make the following replacements:

• PROJECT_ID: The identifier of the project.

Execute the gcloud alpha monitoring alerts list command:

Linux, macOS, or Cloud Shell

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha monitoring alerts list

Windows (PowerShell)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha monitoring alerts list

Windows (cmd.exe)

Note: Ensure you have initialized the Google Cloud CLI with authentication and a project by running either gcloud init; or gcloud auth login and gcloud config set project.

gcloud alpha monitoring alerts list

The command returns a response with alert details such as alert state, attached labels, and the source alerting policy. Note that the labels in the response are subject to change while this feature is in preview. The response looks similar to the following:

{
  "alerts": [
    {
      "name": "projects/my-project/alerts/my-alert-id",
      "state": "OPEN",
      "open_time": "2025-06-11T09:53:46Z",
      "resource": {
        "type": "sql_alert"
      },
      "policy": {
        "name": "projects/my-project/alertPolicies/POLICY_1",
        "displayName": "test-policy"
      },
      "summaryText": "The row count SQL Condition for \"test-policy\" is above the threshold of 1."
    }
  ]
}

You can also use the following optional flags to filter, sort, or modify the output:

• --filter: Provide a filter expression to filter alerts by time or by label. For example, filter by time with --filter='close_time>="2025-09-10T00:00:00Z"', or filter by label with --filter='resource.labels.key="value"'.

• --sort-by: A comma-separated list of fields to sort the output by. For example, --sort-by=open_time.

• --uri: Command outputs a list of resource URIs instead of the default output.

• --limit: Set this flag to 2 or greater to limit the number of alerts returned. Don't use this flag in conjunction with the --filter flag.

Monitoring API

You can use the Monitoring API to get incidents and list incidents.

Get incident

To get details on a single incident with the Monitoring API, use the alerts.get method.

Before using any of the request data, make the following replacements:

• PROJECT_ID: The identifier of the project.
• ALERT_ID: The ID of the alert.

HTTP method and URL:

GET https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts/ALERT_ID

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "x-goog-user-project: PROJECT_ID" \
     "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts/ALERT_ID"

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "x-goog-user-project" = "PROJECT_ID" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts/ALERT_ID" | Select-Object -Expand Content

The command returns a response with alert details such as alert state, attached labels, and the source alerting policy. Note that the labels in the response are subject to change while this feature is in preview. The response looks similar to the following:

{
  "name": "projects/my-project/alerts/my-alert-id",
  "state": "OPEN",
  "open_time": "2025-06-11T09:53:46Z",
  "resource": {
    "type": "sql_alert"
  },
  "policy": {
    "name": "projects/my-project/alertPolicies/POLICY_1",
    "displayName": "test-policy"
  },
  "summaryText": "The row count SQL Condition for \"test-policy\" is above the threshold of 1."
}

List incidents

To list incidents in your project and filter the results with the Monitoring API, use the alerts.list method.

Before using any of the request data, make the following replacements:

• PROJECT_ID: The identifier of the project.

HTTP method and URL:

GET https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "x-goog-user-project: PROJECT_ID" \
     "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts"

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred"; "x-goog-user-project" = "PROJECT_ID" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/alerts" | Select-Object -Expand Content

The command returns a response with alert details such as alert state, attached labels, and the source alerting policy. Note that the labels in the response are subject to change while this feature is in preview. The response looks similar to the following:

{
  "alerts": [
    {
      "name": "projects/my-project/alerts/my-alert-id",
      "state": "OPEN",
      "open_time": "2025-06-11T09:53:46Z",
      "resource": {
        "type": "sql_alert"
      },
      "policy": {
        "name": "projects/my-project/alertPolicies/POLICY_1",
        "displayName": "test-policy"
      },
      "summaryText": "The row count SQL Condition for \"test-policy\" is above the threshold of 1."
    }
  ]
}

Curl users can add the --data-urlencode flag followed by a filter expression to filter alerts by time or label. See the following examples:

List alerts that were opened in the last hour:

--data-urlencode "filter=(open_time>=\"`date -u -d "1 hour ago" +"%Y-%m-%dT%H:%M:%SZ"`\")"

List & filter alerts that are open from the last day:

--data-urlencode "filter=(open_time>=\"`date -u -d "1 DAY ago" +"%Y-%m-%dT%H:%M:%SZ"`\" AND state=open)"

List & filter alerts that were opened between two periods:

--data-urlencode "filter=(open_time>=\"`date -u -d "2 DAY ago" +"%Y-%m-%dT%H:%M:%SZ"`\" AND open_time


Web Proxy Viewer  |  New URL  |  Original Page