Monitors

Monitors evaluate a SQL API query on a schedule. Cloudflare sends a notification when the query result meets your detection criteria. You can create monitors from the Cloudflare dashboard under Alerts > Monitors.

The datasets available to monitors depend on your plan and permissions. The dashboard only lists datasets available to the selected account or zone. For more information about dataset scopes and sampling, refer to SQL API datasets.

1. Go to Alerts > Monitors in the Cloudflare dashboard.
2. Select Create a Monitor.
3. Choose a detection method: Threshold, Anomaly detection, or SLO.
4. Configure the query using the visual builder or enter custom SQL.
5. Set the detection parameters (threshold value, sensitivity, or SLO target).
6. Name the monitor and add a description.
7. Add one or more delivery destinations (email, webhook, or PagerDuty).
8. Select Create.

Each monitor has the following details:

You can add up to 20 email recipients. All plans can use webhooks. PagerDuty requires a Business or higher zone.

Use the query builder or enter custom SQL. The query builder supports these options:

For adaptively sampled datasets, the builder uses APPROX_MIN and APPROX_MAX instead of MIN and MAX. The SQL API automatically applies sample weights to COUNT, SUM, and AVG.

A custom SQL query must meet these requirements:

• Return one numeric value in a column named value.
• Read one schema-qualified SQL API dataset.
• Include an account or zone filter.
• Include a lower timestamp bound when using Manual time-range mode.
• Use the supported SQL syntax.
• Omit a trailing semicolon.

Custom SQL supports two time-range modes:

• Automatic (recommended): Omit the timestamp filter. When the monitor runs, Cloudflare supplies a time range ending at the evaluation time and spanning the execution interval.
• Manual: Add a fixed time range to the SQL query. Relative ranges end at the evaluation time.

For example, this query returns the number of server errors during the previous five minutes:

SELECT COUNT(*) AS value
FROM events.httpRequests
WHERE accountTag = '<ACCOUNT_TAG>'
  AND timestamp >= NOW() - INTERVAL '5' MINUTE
  AND edgeResponseStatus >= 500

Monitors validate the query before saving. Query errors identify unsupported syntax, unavailable datasets or fields, and invalid scope. For SQL API query limits, refer to Limits.

Choose how Cloudflare evaluates the query result:

A threshold monitor compares the query result with a fixed value. It supports these options:

Anomaly detection calculates the number of standard deviations between the current result and its historical baseline. It supports these options:

New anomaly detection monitors require at least 30 minutes of historical data before they can trigger.

An SLO monitor calculates the successful-event percentage from bad and total event counts. Both queries must return a numeric column named value. It supports these options:

Use equivalent filters in both queries. The bad events query should represent a subset of the total events query.

Monitors support two independent frequency settings:

Most SQL API datasets support a one-minute execution interval. Log Explorer datasets support a minimum execution interval of 10 minutes. Cloudflare rejects an interval shorter than the selected dataset supports.

The query preview validates and charts an approximation of the signal before you save. Select a preview range of up to 7 days to inspect how the monitor might behave. The data shown in the preview may differ from the data evaluated by a monitor, including historical evaluations.

Threshold previews show the configured threshold. SLO previews show the calculated percentage and target. A query that returns no rows produces no signal and cannot trigger the monitor for that evaluation.