SQL alert notifications

One message, or one per subject

A grouped rule with twelve subjects breaching at once produces twelve messages in the default mode — and the reader of the first one has no way to tell whether it is alone.

summary changes only the notification. State stays per subject: each keeps its own clocks, its own recovery and its own history. Rolling those up would make the rule recover when the loudest subject did.

What a rollup message looks like

19 of this rule's subjects are breaching:

• drift_sigma [PMax | Europe/scans/EXPIRED] is 2.81 (threshold ≥ 2.5) [spike]
  · measured_window 2026-09-14 00:00-10:00
• drift_sigma [-/scans/ACTIVE] is 6.57 (threshold ≥ 2.5) [spike]
  · measured_window 2026-09-14 00:00-10:00
…and 4 more.

— Clickhouse

The body is bounded twice: at most 25 lines, and at most 2400 characters. The "and N more" is counted against the real total, not against the line cap — saying "and 6 more" when four hundred subjects breached understates the outage by two orders of magnitude, and that number is the whole point of a rollup.

The message template

A rule can carry its own message. Placeholders:

The last one is the useful one. A drift query carrying measured_window and expected_so_far can put both in the message without you restating them:

{group}: {value} against an expected {expected_so_far} over {measured_window}

What the default message says

Without a template, the message is built from what actually decided:

• the label and the subject
• the value, with its unit
• the comparison that was applied — including, for a direction-driven condition, the operator and threshold that row carried rather than the rule's defaults
• up to three text columns as context
• the connection name

Routing

SQL alerts route like everything else — see Notification channels and How alerting works. Each condition carries its own severity, so one query can raise a warning and a critical down different paths in the same run.