Using the Dashboard

Alerts

Get an email when something important happens in your logs, like error spikes, traffic drops or malicious bots.

Alerts watch your traffic for you. You describe a condition, such as "more than 50 server errors in 15 minutes", and Honeylog checks it on a schedule and emails you when it happens. An alert belongs to a single site, or to a whole network if you create it from a network view.

You find Alerts in the Settings group of the sidebar. It is available to members who can administer the site (on a network, to the team owner and managers). If your plan does not include alerts, the sidebar shows an upgrade button instead.

#The alerts list

The main page lists every alert for the current site or network. For each one you see:

  1. The alert name and its description.
  2. The condition, summarised as a sentence such as "Requests >= 50 in 15 min". A small "(filtered)" marker appears when the alert only counts requests matching extra filters.
  3. The status pill, Active or Paused. Click it to pause or resume the alert. A resumed alert is checked again right away.
  4. When it last triggered, and when the next check is due.
  5. How many times it fired in the last 30 days. Click the number to expand the recent trigger history, with the measured value and whether the email was sent.
  6. Edit and delete actions. Deleting an alert also removes its trigger history.

#Creating an alert

Click Create Alert to open the form. The quickest way to start is a template:

  • Server error spike (5xx) — warns when 5xx responses pile up.
  • Traffic drop — warns when requests fall below a minimum, useful to catch outages or a broken installation.
  • Bot traffic spike — warns when recognized bots send an unusual amount of requests.
  • Malicious traffic — warns as soon as requests classified as malicious appear.
  • Slow responses — warns when the average response time gets too high.

Templates only prefill the form. Every field stays editable.

#The condition

An alert condition reads as a sentence: notify me when a metric, measured over a time window, crosses a threshold.

  1. Metric — either Requests (how many requests came in) or Avg response time (ms).
  2. Time window — the trailing period the metric is measured over: 5 minutes, 15 minutes, 1 hour, 6 hours or 24 hours.
  3. Comparison and threshold — greater than, at least, less than or at most a number you choose.
  4. Check every — how often Honeylog evaluates the alert: from every 5 minutes up to once a day.
  5. Cooldown — after an email, the alert stays silent for this long even if the condition keeps matching. This protects your inbox during a long incident.

#Filters

By default the condition looks at all requests of the site. Open Filters to narrow it down using the same filter builder as the rest of the dashboard: status code, pathname, bot name, verified state, country, IP, referrer, UTM parameters and so on. This is how you build precise alerts like "GPTBot requests on /blog" or "POST requests returning 403".

#Preview before saving

The Run preview button backtests your exact configuration against your recent traffic. It shows one bar per time window over the last days, highlights the windows where the condition would have fired, and estimates how many emails you would have received given your cooldown. It is the best way to tune a threshold without waiting for real triggers.

#Recipients

Alerts notify by email. The form starts with your own address and you can add up to 10 recipients. Each recipient receives their own copy, so addresses are never exposed to each other.

#How evaluation works

Honeylog checks due alerts every minute. When your alert's "check every" interval has passed, the metric is measured over the trailing time window and compared to the threshold. If it matches, the trigger is recorded, the email goes out and the cooldown starts.

Two safety valves are built in:

  • At most 10 alert emails per site per day. Further triggers are still recorded in the history, marked as suppressed, but no email is sent.
  • If a saved filter becomes invalid, the alert is paused automatically instead of failing silently. You will see it flip to Paused in the list.

#Limits

The number of alerts you can create depends on your plan and is counted across all your sites and networks together. See Plans & billing for the current limits of each plan.