Tools / Apache HertzBeat Interview Questions
How do multi-expression threshold alarms work in HertzBeat?
Multi-expression alarms go beyond a single metric-vs-threshold comparison by combining multiple metrics with logical operators — AND, OR, and UNLESS — inside one expression, evaluated using PromQL or SQL syntax.
Under the hood, the expression is parsed with an ANTLR v4 grammar, which builds a structured parse tree rather than relying on fragile string matching, so complex boolean logic evaluates reliably. A common pattern is combining a condition with UNLESS to exclude cases matched by another expression, effectively building smart exclusion rules directly into the alert definition instead of relying on manual suppression later.
Multi-expression alarms combine multiple metrics using:
Expressions are parsed under the hood using:
More Related questions...
