Google Cloud Drops SQL Alerting: Query Your Way to Smarter Monitoring

Traditional alerting is like trying to catch a specific fish in a murky swamp with a net full of holes. You either get flooded with noisy log events or stare at rigid metrics that miss the real story—like a 20% error spike for a key customer or a latency anomaly tied to database timeouts. Google Cloud just threw a better net: SQL alerting in Cloud Monitoring’s Observability Analytics (now in preview).

You can now write SQL queries over logs and traces, and turn those queries into alerts. No more compromises. Calculate error percentages, analyze high-cardinality dimensions like user sessions, or JOIN logs and traces—all in one alert. It’s like having a capybara’s calm focus: you see the whole swamp, not just the ripples.

How SQL Alerting Works

SQL alerting is part of Cloud Monitoring. You define a schedule (e.g., every 10 minutes), and the alert runs your query with an automatic lookback window. If results meet your condition, an incident is created and notifications go to email, Slack, or PagerDuty. Note: queries run on BigQuery, so standard pricing applies.

Two Ways to Trigger an Alert

• Row count threshold: Fires if your query returns more than, equal to, or less than a set number of rows. Perfect for “alert me if more than 10 users have failed logins.”
• Boolean: Fires if any row has a specific column set to true. This lets you build complex logic like percentage calculations directly in SQL.

Example 1: Payment Gateway Failures (Row Count)

As an e-commerce operator, you want to know when your payment gateway has systemic outages, not just occasional card declines. Write a query that filters for gateway timeout errors, and set a row count threshold to trigger only when the volume spikes.

SELECT
  JSON_VALUE(json_payload.transaction_id) AS transaction_id,
  JSON_VALUE(json_payload.error_code) AS error_code
FROM
  `my-project-id.my-dataset.my-log-view`
WHERE
  JSON_VALUE(json_payload.status) = 'FAILED'
  AND JSON_VALUE(json_payload.failure_reason) = 'GATEWAY_TIMEOUT'

Alert config: Condition type: Row count threshold, Trigger: > 10, Lookback: 5 minutes.

Example 2: AI Agent Latency (Boolean)

As an AI platform engineer, you need to monitor p99 latency of your orchestrator service. Write a query that calculates p99 and returns a boolean column has_latency_spike if it exceeds 5 seconds.

WITH latency_data AS (
  SELECT
    APPROX_QUANTILES(duration_nano, 100)[OFFSET(99)] / 1000000 AS p99_ms
  FROM
    `my-project-id.us._Trace.Spans._AllSpans`
  WHERE
    JSON_VALUE(resource.attributes, '$."service.name"') = 'agent-orchestrator'
  GROUP BY
    service_name
)
SELECT
  "agent-orchestrator" AS service_name,
  p99_ms,
  (p99_ms > 5000) AS has_latency_spike
FROM
  latency_data

Alert config: Condition type: Boolean, Target column: has_latency_spike, Trigger: any row true, Lookback: 10 minutes.

Before You Begin

1. Analytics enabled: Upgrade your log bucket to Observability Analytics, and ensure Cloud Trace is collected.
2. Linked BigQuery dataset: Create a linked dataset for your log bucket or trace dataset.
3. IAM permissions: Grant Monitoring AlertPolicy Editor and Logging SqlAlert Writer roles.
4. Notification channels: Configure email, Slack, or PagerDuty.

How to Create Your Alert

1. Go to Observability Analytics in the Google Cloud console.
2. Compose and validate your SQL query.
3. Select the Run on BigQuery engine.
4. Click Create alert from the results toolbar.
5. Define your condition and schedule.
6. Add notification channels, name your alert, and save.

For Infrastructure as Code, use the API or Terraform.

Get Started

Ready to build smarter alerts? Open Observability Analytics and write your first SQL query. For more details, check the official documentation.

If you’re exploring observability platforms, check out our reviews of Google Cloud, Supabase, and Neon Database for more insights.

Original announcement published on Google Cloud.