---
title: Tracing alerts
description: Alert on spans that exceed a latency threshold across the services and tags you select, using a trace count condition.
url: https://coralogix.com/docs/user-guides/alerting/create-an-alert/traces/tracing-alerts/
product: alerts
feature: Span Alerts
feature_id: spans.alerts
feature_identifier: alerts/spans.alerts
last_updated: '2026-10-13'
---

# Tracing alerts

Tracing alerts notify you when spans matching your filters exceed a latency threshold. Use them to catch slow or failing operations on specific services, tags, applications, or subsystems, so you find performance bottlenecks before they affect more users.

A tracing alert evaluates spans you select on the Query step and fires based on how many qualifying spans occur on the Condition step.

## What you need

* Access to Coralogix with permission to create alerts
* Trace data ingesting from the services you want to monitor

## Build a tracing alert

To create a tracing alert, go to **Alerts**, then select **Create alert**. The [alert creation wizard](https://coralogix.com/docs/user-guides/alerting/configuring-alert-definition.md) opens on the Query step. The Tracing type uses the same four-step flow as every alert (Query, then Condition, then Notification, then Details); the parts below are specific to tracing.

### Query: select spans and filters

1. On the Query step, select the **Tracing** alert type.

2. Set **Latency is above (ms)** to the maximum latency you tolerate. Spans slower than this value count toward the alert.

3. Narrow the spans with filters:

   <!-- -->

   * **Span tags**: add a tag as a **Key** and **Value** pair to include only matching spans. The value can be matched with **Is**, **Starts with**, **Includes**, or **Ends with**.
   * **Application**, **Subsystem**, and **Services**: scope the alert to specific sources, or leave **All** selected. Each span can carry a different application or subsystem.

### Condition: trace count threshold

On the Condition step, define how many qualifying spans trigger the alert:

* Trigger immediately on a match, or require a number of occurrences within a time window.
* The alert fires when the count threshold is met for an aggregated value within the time frame.
* With **Group by** set, matching spans are aggregated by the selected fields, and the alert fires on the unique combination of those values. Only spans that include all selected group-by fields are counted.

For the Notification and Details steps, including routing, cadence, alert scheduling, naming, and labels, see [Configuring an alert definition](https://coralogix.com/docs/user-guides/alerting/configuring-alert-definition.md). To silence a tracing alert so it can serve as a building block in a flow alert without firing on its own, enable Phantom mode on the Notification step.

## Related resources

[Configuring an alert definition](https://coralogix.com/docs/user-guides/alerting/configuring-alert-definition.md)[Notification Center](https://coralogix.com/docs/user-guides/notification-center/introduction.md)[Cases](https://coralogix.com/docs/user-guides/cases/overview.md)

## Next steps

Combine multiple alerts into a staged trigger with [Flow alerts](https://coralogix.com/docs/user-guides/alerting/create-an-alert/flow-alerts.md).