Difference between Monitors and Scheduled Searches
To understand the difference between Monitors and Scheduled Searches, it's essential to recognize the specific use cases each solution addresses.
Scheduled Searches
Scheduled Searches address two primary use cases:
- Alerting about specific issues in your application. For example, you can create Scheduled Searches to notify you about a spike in the error rate for a service or a stopped process.
- Reporting specific insights from searches on a periodic schedule. For instance, you can schedule a search to run daily, notifying you about the Daily Active Users on your platform.
Monitors
Monitors are specifically designed for the first use case: alerting. They offer additional capabilities such as auto-resolution and support for multiple notification channels. Any Scheduled Searches created for alerting purposes can be moved to Monitors, including real-time Scheduled Searches.
Feature differences
Beyond the differences in use cases, there are distinct feature differences between Scheduled Searches and Monitors for logs.
| Feature | Scheduled Searches | Monitors (Logs) |
|---|---|---|
| Support for Slack, PagerDuty, OpsGenie, and other integrations | Yes | Yes |
| Customizable notifications | Yes | Yes |
| Incident auto-resolution | No | Yes |
| Send notification to multiple channels | No | Yes |
| Alert disablement | No | Yes* (Disable is a manual operation. We do not support scheduled disabling of alerts.) |
| API support | Partial* (Supported via content sync API) | Yes |
| Terraform support | Yes (see content API resource) | Yes |
| Log Search operator support | Yes* (Some operators are not supported for real-time alerts) | Yes |
| Outlier-based alerts | Yes | Yes |
| Access control | Object-Level Access Control | Object-Level Access Control (Per request - limited availability) |
| Audit logs for CRUD and system events (e.g., notifications sent, failures) | Yes | Yes |
| Control over alert scheduling and evaluation | Yes | No |
| One notification per log line | Yes | Yes* (Supported via Alert grouping) |