--- title: Flow alerts description: Trigger an alert when a defined set of other alerts is in a triggered state across a sequence of time-bound stages. url: https://coralogix.com/docs/user-guides/alerting/create-an-alert/flow-alerts/ product: alerts feature: Flow Alerts feature_id: flow-alert feature_identifier: alerts/flow-alert last_updated: '2026-10-13' --- # Flow alerts Flow alerts notify you when several alerts are triggering together across a sequence of time-bound stages. Use them to correlate signals across logs, metrics, traces, and security, so you alert on a combination of conditions rather than isolated symptoms, and surface a likely root cause. For example, to catch an HTTP error spike alongside high CPU, configure a flow alert with a high CPU utilization alert in the first stage and a high HTTP error rate alert in the second. ## What you need * Access to Coralogix with permission to create alerts * The individual alerts you want to chain, already created ## How a flow is structured You assemble a flow from two building blocks in the flow builder: * **Group**: a logical combination of individual alerts, joined with the **OR**, **AND**, and **NOT** operators. * **Stage**: one or more groups that must trigger within a specified time frame. A flow is an ordered series of stages. [![Flow alert groups within a stage](/docs/assets/images/Flow-Alert-Groups-and-Stages-057cac5488f449ac2f3f9d2d4cd11eab.webp)](https://coralogix.com/docs/assets/images/Flow-Alert-Groups-and-Stages-057cac5488f449ac2f3f9d2d4cd11eab.webp) Shows how individual alerts combine into groups, and groups into a time-bound stage. ### How a stage is satisfied Coralogix evaluates the stages in order, from left to right. * **Stage 1 is the entry point.** The flow starts only when stage 1's alert triggers. Until then, nothing else is assessed. * **Each later stage opens a time frame.** That stage is satisfied if its alert is in a triggered state at any point inside the frame. * **When the alert started does not matter.** An alert that began triggering before the previous stage still satisfies its stage, as long as it is still triggering when the stage is assessed. That last point is the one that surprises people. A flow describes alerts that overlap in time, not a strict chain of events in sequence. Take a two-stage flow with a 30-minute frame on the second stage: | What happens | Result | | ---------------------------------------------------------------------------------------- | ------------------------------------ | | Stage 1 triggers at 12:00. Stage 2 triggers at 12:05. | Fires | | Stage 1 triggers at 12:00. Stage 2 has been triggering since 11:55 and has not resolved. | Fires | | Stage 1 triggers at 12:00. Stage 2 triggers at 12:35, outside the frame. | Does not fire | | Stage 1 never triggers. | Does not fire, whatever stage 2 does | The second row is the behavior worth knowing. Stage 2's alert started before stage 1's and the flow still fires, because the stage asks whether the alert is triggering, not when it started. ### Limitations * The cumulative time frame across all stages cannot exceed 168 hours (1 week). A larger value resets to zero. * A single flow alert can combine a maximum of 30 alerts. * The following alert types do not support the **NOT** operator: * New value * Unique count * Immediate ## Build a flow alert To create a flow alert, go to **Alerts**, then select **Create alert**. The [alert creation wizard](https://coralogix.com/docs/user-guides/alerting/configuring-alert-definition.md) opens on the Query step. The Flow type uses the same four-step flow as every alert (Query, then Condition, then Notification, then Details). Naming, labels, and scheduling now come last on the Details step, not first; the steps below cover the flow-specific work. ### Query and condition: build the sequence 1. On the Query step, select the **Flow** alert type, then select **Open Flow Builder**. 2. Drag existing alerts from the left panel into the builder workspace. Hover an alert to see its **Query**, **Conditions**, and **Group by** fields. 3. Organize the alerts into groups and stages, and set a time frame for each stage. 4. Select **Apply** to save the flow. 5. Select the **Group by** keys for the flow. Note The available **Group by** keys are the intersection of the keys across the alerts in the flow. If alert A is grouped by `Region` and `Cluster`, and alert B is grouped by `Region` and `Pod`, the flow can only group by `Region`. Hover an alert in the builder to see its available keys. To keep a constituent alert from firing on its own, enable Phantom mode on that alert. Only the flow then triggers a notification and opens an incident, while its building-block alerts stay silent. For the Notification and Details steps, including routing, cadence, alert scheduling, naming, and labels, see [Configuring an alert definition](https://coralogix.com/docs/user-guides/alerting/configuring-alert-definition.md) and [Define alert details](https://coralogix.com/docs/user-guides/alerting/define-alert-details.md). ## Example The following flow notifies you when successful orders drop because of a failed database cleanup task that ran 24 hours earlier. [![Flow alert correlating a failed cleanup task with a later drop in successful orders](/docs/assets/images/image-12-1024x483-318ddecbc8def4a4b18e109c78e93b30.webp)](https://coralogix.com/docs/assets/images/image-12-1024x483-318ddecbc8def4a4b18e109c78e93b30.webp) Shows a two-stage flow linking an earlier failure to a later business-metric drop. ## Related resources [Configuring an alert definition](https://coralogix.com/docs/user-guides/alerting/configuring-alert-definition.md)[Introduction to alerts](https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts.md)[Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction.md) ## Next steps Configure alert name, description, and labels in [Define alert details](https://coralogix.com/docs/user-guides/alerting/define-alert-details.md).