Create¶

POST /api/v1/checker/add

Overview¶

Create a Monitor

Body Request Parameters¶

Parameter	Type	Required	Description
queryType	string		DQL front-end echo mode used for validation when `extend.querylist` is not passed. `simple` means Studio parses and injects simple mode fields, `dql` means DQL text mode; default `dql`. When `extend.querylist` is explicitly passed, it is used as-is and the injection semantics of `queryType` are ignored; if `simple` conversion fails, it automatically falls back to `dql`, without changing the actual DQL executed in `jsonScript.targets`. Allow empty: False Example: simple
type	string		Monitor type, default `trigger`. `trigger`: standard monitor, `smartMonitor`: Intelligent Monitoring. Allow empty: False Example: smartMonitor
status	integer		Monitor status field, 0 enabled, 2 disabled, default enabled. (Added in 2025-02-19 iteration) Allow empty: False Allowed values: [0, 2]
extend	json		Extra information (Incident-related fields and some front-end echo fields) Allow empty: True
alertPolicyUUIDs	array		Alert Policy UUIDs Allow empty: False
dashboardUUID	string		Associated dashboard ID Allow empty: False
tags	array		Tag names for filtering Allow empty: False Example: ['xx', 'yy']
secret	string		Webhook URL middle segment unique identifier `secret` (usually a random UUID, must be unique within the workspace) Allow empty: False Example: secret_xxxxx
jsonScript	json		Rule configuration Allow empty: False
jsonScript.targetWorkspaceUUID	string		Target workspace for cross-workspace queries, only supported for threshold detection type. (Added in 2025-08-13 iteration) Allow empty: False Allow empty string: False
jsonScript.type	string	Y	Check method type Example: simpleCheck Allow empty: False
jsonScript.windowDql	string		Window DQL Allow empty: False
jsonScript.title	string	Y	Generated event title template Example: Monitor: `{{monitor_name}}` Checker:`{{monitor_checker_name}}` TriggerValue:`{{M1}}` Allow empty: False Allow empty string: True Max length: 256
jsonScript.message	string		Event content Example: status: {{status}}, title:`{{title}}` Allow empty: False Allow empty string: True
jsonScript.recoverTitle	string		Recovery event title template Example: Monitor: `{{monitor_name}}` Checker:`{{monitor_checker_name}}` TriggerValue:`{{M1}}` Allow empty: False Allow empty string: True
jsonScript.recoverMessage	string		Recovery event message template Example: status: {{status}}, title:`{{title}}` Allow empty: False Allow empty string: True
jsonScript.noDataTitle	string		No-data event title template Example: Monitor: `{{monitor_name}}` Checker:`{{monitor_checker_name}}` TriggerValue:`{{M1}}` Allow empty: False Allow empty string: True
jsonScript.noDataMessage	string		No-data event message template Example: status: {{status}}, title:`{{title}}` Allow empty: False Allow empty string: True
jsonScript.openNotificationMessage	boolean		Whether to enable event notification content. Default disabled (use event content as notification content). Example: False Allow empty: False
jsonScript.notificationMessage	string		Event notification content Example: Monitor: `{{monitor_name}}` Checker:`{{monitor_checker_name}}` TriggerValue:`{{M1}}` Allow empty: False Allow empty string: True
jsonScript.openNoDataNotificationMessage	boolean		Whether to enable no-data event notification content. Default disabled (use no-data event content as notification content). Example: False Allow empty: False
jsonScript.noDataNotificationMessage	string		No-data event notification content Example: status: {{status}}, title:`{{title}}` Allow empty: False Allow empty string: True
jsonScript.noDataRecoverTitle	string		No-data recovery event title template Example: Monitor: `{{monitor_name}}` Checker:`{{monitor_checker_name}}` TriggerValue:`{{M1}}` Allow empty: False Allow empty string: True
jsonScript.noDataRecoverMessage	string		No-data recovery event message template Example: status: {{status}}, title:`{{title}}` Allow empty: False Allow empty string: True
jsonScript.every	string		Check frequency Example: 1m Allow empty: False
jsonScript.customCrontab	string		Custom check frequency Example: 0 /12 * * Allow empty: False
jsonScript.delaySeconds	integer		Data waiting window for standard monitors, in seconds. 0 means no wait; not supported by Intelligent Monitoring. Example: 60 Allow empty: False Allowed values: [0, 60, 120, 180, 300, 600, 900, 1800]
jsonScript.interval	integer		Query interval, i.e., the time range delta for a single query Example: 60 Allow empty: False
jsonScript.range	integer		Range parameter for Senior Check and Mutation Detection, in seconds Example: 3600 Allow empty: False
jsonScript.range_2	integer		Range_2 parameter for Senior Check and Mutation Detection, in seconds. Special note: -1 means month-over-month, 0 means use `periodBefore` field. Example: 600 Allow empty: False
jsonScript.periodBefore	integer		Period before parameter for Senior Check and Mutation Detection (yesterday/one hour ago), in seconds Example: 600 Allow empty: False
jsonScript.recoverNeedPeriodCount	integer		Specifies after how many check periods a recovery event is generated. If check frequency is a custom crontab, this field represents time length in seconds; otherwise, it represents the number of check periods. Example: 60 Allow empty: False
jsonScript.noDataInterval	integer		How long without data to trigger a no-data event Example: 60 Allow empty: False
jsonScript.noDataAction	string		No-data handling action Allow empty: False Allowed values: ['none', 'checkAs0', 'noDataEvent', 'fatalEvent', 'criticalEvent', 'errorEvent', 'warningEvent', 'okEvent', 'noData', 'recover']
jsonScript.checkFuncs	array		List of check function information Example: [{'funcId': 'xxx', 'kwargs': {}}] Allow empty: False
jsonScript.groupBy	array		Trigger dimensions Example: ['gender'] Allow empty: False
jsonScript.targets	array		Check targets Example: [{'dql': 'M::`soldier_info`:(AVG(`potential_value`)) [::auto] by `gender`', 'alias': 'M1'}] Allow empty: False
jsonScript.checkerOpt	json		Check condition settings Allow empty: False
jsonScript.checkerOpt.disableLargeScaleEventProtect	boolean		Whether to disable large-scale event protection. Default false. Example: True
jsonScript.checkerOpt.script	string		Script content for programmable monitoring Allow empty: False Allow empty string: True
jsonScript.checkerOpt.rules	array		Trigger condition list Example: [{'status': 'warning', 'conditions': [{'operands': [60], 'operator': '>', 'alias': 'M1'}], 'conditionLogic': 'and', 'matchTimes': 10}] Allow empty: False
jsonScript.checkerOpt.openOkConditions	boolean		Enable graded recovery. Default disabled (false). Example: True
jsonScript.checkerOpt.openMatchTimes	boolean		Enable consecutive trigger judgment. Default disabled (false). Example: True
jsonScript.checkerOpt.infoEvent	boolean		Whether to generate an info event when continuously normal. Default false. Example: True
jsonScript.checkerOpt.infoEventCondition	json		Info event generation condition. Only supported by threshold monitors. Empty object means unconditional generation. Example: {'alias': 'M1', 'operator': '>=', 'operands': [60]} Allow empty: False
jsonScript.checkerOpt.infoEventCondition.alias	string		Judgment object alias
jsonScript.checkerOpt.infoEventCondition.operator	string		Judgment operator
jsonScript.checkerOpt.infoEventCondition.operands	array		List of judgment operands
jsonScript.checkerOpt.diffMode	string		Difference mode for mutation detection in Senior Check. Enum values: value, percent. Example: value Allowed values: ['value', 'percent']
jsonScript.checkerOpt.direction	string		Trigger condition direction for mutation detection and range detection in Senior Check Example: up Allowed values: ['up', 'down', 'both']
jsonScript.checkerOpt.eps	float		Distance parameter, value range: 0 ~ 3.0 Example: 0.5
jsonScript.checkerOpt.threshold	json		Trigger precondition settings for mutation detection Allow empty: False
jsonScript.checkerOpt.threshold.status	boolean	Y	Whether the trigger precondition for mutation detection is enabled Example: True
jsonScript.checkerOpt.threshold.operator	string	Y	Trigger precondition operator for mutation detection Example:
jsonScript.checkerOpt.threshold.value	float	Y	Trigger precondition check value for mutation detection Example: 90 Allow empty: True
jsonScript.checkerOpt.combineExpr	string		Combination expression for combined monitoring Example: A && B Allow empty string: False
jsonScript.checkerOpt.ignoreNodata	boolean		Whether to ignore no-data results for combined monitoring (true means ignore) Example: True
jsonScript.checkerOpt.confidenceInterval	integer		Range Detection V2 new parameter. Confidence interval range, value 1-100. Example: 10
jsonScript.channels	array		Channel UUID list Example: ['name1', 'name2'] Allow empty: False
jsonScript.atAccounts	array		List of account UUIDs to be @mentioned in normal detection Example: ['xx1', 'xx2'] Allow empty: False
jsonScript.atNoDataAccounts	array		List of account UUIDs to be @mentioned in no-data scenarios Example: ['xx1', 'xx2'] Allow empty: False
jsonScript.subUri	string		Webhook URL suffix for OuterEventChecker. Required when creating; uniqueness not required. Example: datakit/push Allow empty: False
jsonScript.isChangeEvent	boolean		Whether OuterEventChecker is treated as a change event. Default false. Missing field in existing rules is treated as false. Example: False Allow empty: False
jsonScript.disableCheckEndTime	boolean		Whether to disable end time restriction Example: True Allow empty: False
jsonScript.eventChartEnable	boolean		Whether to enable event charts. Default disabled. (Only takes effect when the primary storage engine for logging is Doris.) Example: False Allow empty: False
jsonScript.eventCharts	array		Event chart list Example: True Allow empty: False
jsonScript.eventCharts[*]	None
jsonScript.eventCharts[*].dql	string		Event chart query statement Example: M::`cpu`:(avg(`load5s`)) BY `host` Allow empty: False
openPermissionSet	boolean		Enable custom permission configuration. (Default false: disabled). When enabled, the operation permissions for this rule are based on `permissionSet`. Allow empty: False
permissionSet	array		Operation permission configuration. Can be configured with (roles (except owner), member UUIDs, team UUIDs). Example: ['wsAdmin', 'acnt_xxxx', 'group_yyyy'] Allow empty: False

Parameter Supplementary Notes¶

Data notes.

jsonScript parameter description

1. Check type jsonScript.type description

key	Description
simpleCheck	Threshold Detection
seniorMutationsCheck	Mutation Detection
seniorRangeCheck	Range Detection
seniorRangeV2Check	Range Detection V2
outlierCheck	Outlier Detection
loggingCheck	Log Detection
processCheck	Process Anomaly Detection
objectSurvivalCheck	Infrastructure Survival Detection
objectSurvivalV2Check	Infrastructure Survival Detection V2, Doris spaces only
objectChangeCheck	Infrastructure Change Detection
apmCheck	APM Metric Detection
rumCheck	RUM Metric Detection
securityCheck	Security Check Anomaly Detection
cloudDialCheck	Synthetic Testing Anomaly Detection
networkCheck	Network Data Detection
OuterEventChecker	External Event Detection
smartHostCheck	Intelligent Monitoring - Host Intelligent Detection
smartLogCheck	Intelligent Monitoring - Log Intelligent Detection
smartApmCheck	Intelligent Monitoring - APM Intelligent Detection
smartRumCheck	Intelligent Monitoring - RUM Intelligent Detection
smartKubeCheck	Intelligent Monitoring - Kubernetes Intelligent Detection
smartCloudBillingCheck	Intelligent Monitoring - Cloud Billing Intelligent Detection
combinedCheck	Combined Monitoring
programmableCheck	Programmable Monitor

2. Deprecated check types jsonScript.type description

key	Description
seniorCheck	Senior Check, deprecated
mutationsCheck	Mutation Check, deprecated, replaced by `seniorMutationsCheck`
waterLevelCheck	Water Level Check, deprecated
rangeCheck	Range Check, deprecated, replaced by `seniorRangeCheck`

3. Trigger condition comparison operator description (parameters in checkerOpt.rules)

Parameter	Type	Required	Description
conditions	Array[Dict]	Y	Conditions
conditions[#].alias	String	Y	Detection object alias, i.e., `targets[#].alias`
conditions[#].operator	String	Y	Operator. =, >, <, etc.
conditions[#].operands	Array[Any]	Y	Operand array. (Operators like `between`, `in` require multiple operands)
conditionLogic	string	Y	Logic between conditions. `and`, `or`
status	string	Y	Status of the generated event when condition is met. Same as event status values.
direction	string		[Range/Water Level/Mutation parameters] Detection direction. Values: `"up"`, `"down"`, `"both"`
periodNum	integer		[Range/Water Level/Mutation parameters] Only detect the most recent data points
checkPercent	integer		[Range parameters] Anomaly percentage threshold. Values: 1 ~ 100
checkCount	integer		[Water Level/Mutation parameters] Number of consecutive anomaly points
strength	integer		[Water Level/Mutation parameters] Detection strength. Values: 1=weak, 2=medium, 3=strong
matchTimes	integer		Number of consecutive trigger configurations (`checkerOpt.openMatchTimes`). Range [1,10]
okConditions	Array[Dict]		Recovery conditions
okConditions[#].alias	String		Detection object alias, i.e., `targets[#].alias`
okConditions[#].operator	String		Operator. =, >, <, etc.
okConditions[#].operands	Array[Any]		Operand array. (Operators like `between`, `in` require multiple operands)

4. Simple/Log/Water Level/Mutation/Range Check jsonScript.type in (simpleCheck, loggingCheck, waterLevelCheck, mutationsCheck, rangeCheck, securityCheck) parameters

Parameter	Type	Required	Description
title	string	Y	Generated fault event title template
message	string	N	Generated fault event message template
recoverTitle	string	N	Recovery event title template
recoverMessage	string	N	Recovery event message template
noDataTitle	string	N	No-data event title template
noDataMessage	string	N	No-data event message template
noDataRecoverTitle	string	N	No-data recovery event title template
noDataRecoverMessage	string	N	No-data recovery event message template
openNotificationMessage	boolean	N	Whether to enable event notification content
notificationMessage	string	N	Event notification content
openNoDataNotificationMessage	string	N	Whether to enable no-data event notification content
noDataNotificationMessage	string	N	No-data event notification content
name	string	Y	Rule name
type	string	Y	Rule type
every	string	Y	Check frequency, unit (1m/1h/1d)
customCrontab	string	N	Custom check frequency crontab
delaySeconds	integer	N	Data waiting window, in seconds. Supports 0, 60, 120, 180, 300, 600, 900, 1800. Default is 0.
interval	integer	Y	Time range delta for data, i.e., time_range delta in seconds
recoverNeedPeriodCount	integer	Y	Generates recovery event after exceeding the specified number of check periods. If check frequency is custom crontab, this field represents time length in seconds; otherwise, the number of check periods.
noDataInterval	integer	N	How long without data to trigger a no-data event
noDataAction	string	N	No-data handling action
targets	array	Y	Check target list for simple checks
targets[*].dql	string	Y	DQL query statement
targets[*].alias	string	Y	Alias
targets[*].monitorCheckerId	string	Y	Monitor ID for combined monitoring (rul_xxxxx)
checkerOpt	json	N	Check configuration, optional
checkerOpt.rules	array	Y	Check rule list
checkerOpt.openMatchTimes	boolean	N	Enable consecutive trigger judgment. Default disabled (false).
checkerOpt.openOkConditions	boolean	N	Enable recovery condition configuration. Default disabled (false).
checkerOpt.disableLargeScaleEventProtect	boolean	N	Whether to disable large-scale event protection. Default false.

5. jsonScript.noDataAction parameter values

Value	Description
none	No action (equivalent to [disable no-data related processing])
checkAs0	Treat query result as 0
noDataEvent	Trigger a no-data event
fatalEvent	Trigger a fatal event
criticalEvent	Trigger a critical event
errorEvent	Trigger an error event
warningEvent	Trigger a warning event
okEvent	Trigger an ok event
noData	Generate a no-data event. This parameter was deprecated on 2024-04-10; its functionality is equivalent to `noDataEvent`. Replace with `noDataEvent`.
recover	Trigger a recovery event. This parameter was deprecated on 2024-04-10; its functionality is equivalent to `okEvent`. Replace with `okEvent`.

6. Senior Check jsonScript.type in (seniorCheck) parameters

Parameter	Type	Required	Description
title	string	Y	Generated fault event title template
message	string	N	Generated fault event message template
recoverTitle	string	N	Recovery event title template
recoverMessage	string	N	Recovery event message template
noDataTitle	string	N	No-data event title template
noDataMessage	string	N	No-data event message template
noDataRecoverTitle	string	N	No-data recovery event title template
noDataRecoverMessage	string	N	No-data recovery event message template
type	string	Y	Rule type
every	string	Y	Check frequency, unit (1m/1h/1d)
customCrontab	string	N	Custom check frequency crontab
delaySeconds	integer	N	Data waiting window, in seconds. Supports 0, 60, 120, 180, 300, 600, 900, 1800. Default is 0.
checkFuncs	array	Y	Senior check function list. Note: it must have exactly one element.
checkFuncs[#].funcId	string	Y	Function ID. Obtain via the [List External Functions] interface with `funcTags=monitorType\|custom`.
checkFuncs[#].kwargs	json	N	Parameter data required by the senior function

7. Mutation Detection seniorMutationsCheck parameters

Parameter	Type	Required	Description
jsonScript.range	integer	N	Detection metric Result period 1
jsonScript.range_2	integer	N	Detection metric Result period 2. Special note: -1 means month-over-month, 0 means use `periodBefore` field.
jsonScript.periodBefore	integer	N	When `jsonScript.range_2` is 0, this field indicates (yesterday/one hour ago).
jsonScript.checkerOpt.diffMode	string	N	Difference mode for mutation detection (value: difference, percent: difference percentage)
jsonScript.checkerOpt.threshold.status	boolean	N	Trigger precondition setting for mutation detection, enable/disable
jsonScript.checkerOpt.threshold.operator	string	N	Trigger precondition setting for mutation detection, operator
jsonScript.checkerOpt.threshold.value	float	N	Trigger precondition setting for mutation detection, check value

8. Combined Monitoring related fields

Parameter	Type	Required	Description
jsonScript.checkerOpt.combineExpr	string	Y	Combination expression, e.g., A && B
jsonScript.checkerOpt.ignoreNodata	boolean	N	Whether to ignore no-data results (true means ignore)

9. External Event Detection jsonScript.type in (OuterEventChecker) related fields

Parameter	Type	Required	Description
secret	string	N	Unique identifier for identifying the monitor to which the event belongs. Globally unique. Omitted at creation, Studio generates one. Import does not reuse old values.
jsonScript.subUri	string	Y	Webhook URL suffix. Required when creating; uniqueness not required.
jsonScript.isChangeEvent	boolean	N	Whether to treat as a change event. Default `false`. Missing field in existing rules is also treated as `false`.

10. Field disableCheckEndTime description

Guance processes reported data in two modes: append-write and update-overwrite. Based on the characteristics of these two modes, monitoring detection needs to treat them differently. This distinction applies to all modules: Monitor, Intelligent Monitoring, and Intelligent Inspection.

When configuring a monitor for data types that use the update-overwrite mechanism, to avoid data escaping within a fixed time range due to the 1-minute delay in monitor execution, the detection interval for such monitor types does not specify an end time.

Involved monitor types: Threshold Detection, Mutation Detection, Range Detection, Outlier Detection, Process Anomaly Detection, Infrastructure Survival Detection, RUM Metric Detection (individual metrics, see table below).

Data Type	Namespace	Write Mode
Metric	M	Append
Event	E	Append
Unrecovered Events	UE	Overwrite
Infrastructure - Object	O	Overwrite
Infrastructure - Custom Object	CO	Overwrite
Infrastructure - Object History	OH	Append
Infrastructure - Custom Object History	COH	Append
Log / Synthetic Monitoring / CI Visibility	L	Append
APM - Trace	T	Append
APM - Profile	P	Append
RUM - Session	R::session	Overwrite
RUM - View	R::view	Overwrite
RUM - Resource	R::resource	Append
RUM - Long Task	R::long_task	Append
RUM - Action	R::action	Append
RUM - Error	R::error	Append
Security Check	S

All data types with write mode Overwrite must set disableCheckEndTime to true.

11. Range Detection V2 version related fields

Parameter	Type	Required	Description
jsonScript.checkerOpt.confidenceInterval	integer	Y	Confidence interval range, value 1-100%

12. Monitor operation permission configuration parameters

Parameter	Type	Description
openPermissionSet	boolean	Whether to enable custom permission configuration. Default false.
permissionSet	array	Operation permission configuration

permissionSet, openPermissionSet field description (added in 2024-06-26 iteration):

When openPermissionSet is enabled, only the workspace owner and the roles, teams, and members configured in permissionSet can edit/enable/disable/delete.

When openPermissionSet is disabled (default), the edit/enable/disable/delete permissions follow the original interface permissions.

The permissionSet field can be configured with: role UUID (wsAdmin, general, readOnly, role_xxxxx), team UUID (group_yyyy), member UUID (acnt_xxx).

Example of permissionSet:

  ["wsAdmin", "general", "group_yyyy", "acnt_xxxx"]

13. Associated Incident configuration

Parameter	Type	Description
extend.isNeedCreateIssue	boolean	Whether to associate with Incident. Default not associated.
extend.issueDfStatus	array	Optional 5 types (fatal, critical, error, warning, nodata). When `issueDfStatus` exists: an Issue is created only if the event's `df_status` is in `issueDfStatus`. When `issueDfStatus` is absent, an Issue is created for all events.
extend.issueLevelUUID	string	Issue level UUID
extend.manager	array	Person responsible when creating an Issue (email/workspace member/team). Example: `["xxx@guance.com","acnt_yyyy","group_"]`
extend.needRecoverIssue	boolean	Whether the event recovery should also close the Issue. Default false.
jsonScript.channels	string	When `isNeedCreateIssue` is true, this field is required. Issue channel information. Example: `["chan_xxx", "chan_yyy"]`

14. DQL echo mode queryType description

When extend.querylist is not passed, queryType is an optional outer field that controls automatic injection. Only simple and dql are supported. Default is dql when not passed. When simple is passed, Studio uses the local DQL parser to parse and inject simple mode fields from jsonScript.targets. If parsing or conversion fails, it automatically falls back to DQL text mode. When extend.querylist is explicitly passed, the caller's structure is fully preserved and the injection semantics of queryType are ignored.

Request Example¶

curl 'https://openapi.guance.com/api/v1/checker/add' \
-H 'DF-API-KEY: <DF-API-KEY>' \
-H 'Content-Type: application/json;charset=UTF-8' \
--data-raw '{"queryType":"simple","extend":{"funcName":"","isNeedCreateIssue":false,"issueLevelUUID":"","needRecoverIssue":false,"querylist":[{"datasource":"dataflux","qtype":"dql","query":{"alias":"","code":"Result","dataSource":"ssh","field":"ssh_check","fieldFunc":"count","fieldType":"float","funcList":[],"groupBy":["host"],"groupByTime":"","namespace":"metric","q":"M::`ssh`:(count(`ssh_check`)) BY `host`","type":"simple"},"uuid":"aada629a-672e-46f9-9503-8fd61065c382"}],"rules":[{"conditionLogic":"and","conditions":[{"alias":"Result","operands":["90"],"operator":">="}],"status":"critical"},{"conditionLogic":"and","conditions":[{"alias":"Result","operands":["0"],"operator":">="}],"status":"error"}]},"jsonScript":{"atAccounts":[],"atNoDataAccounts":[],"channels":[],"checkerOpt":{"infoEvent":false,"rules":[{"conditionLogic":"and","conditions":[{"alias":"Result","operands":["90"],"operator":">="}],"status":"critical"},{"conditionLogic":"and","conditions":[{"alias":"Result","operands":["0"],"operator":">="}],"status":"error"}]},"disableCheckEndTime":false,"every":"1m","groupBy":["host"],"interval":300,"message":">Level：{{status}}  \n>Host：{{host}}  \n>Content：Host SSH Status {{ Result |  to_fixed(2) }}%  \n>Suggestion：Check Host SSH Service Status","noDataMessage":"","noDataTitle":"","recoverNeedPeriodCount":2,"targets":[{"alias":"Result","dql":"M::`ssh`:(count(`ssh_check`)) BY `host`","qtype":"dql"}],"title":"Host {{ host }} SSH Service Exception-Add Alert Policy","type":"simpleCheck"},"alertPolicyUUIDs":["altpl_xxxx32","altpl_xxxx32"]}' \
--compressed

Response¶

{
    "code": 200,
    "content": {
        "alertPolicyUUIDs": [
            "altpl_xxxx32",
            "altpl_xxxx32"
        ],
        "createAt": 1710831393,
        "createdWay": "manual",
        "creator": "wsak_xxxx",
        "crontabInfo": {
            "crontab": "*/1 * * * *",
            "id": "cron-2n8ZyrMWKXB8"
        },
        "declaration": {
            "b": [
                "asfawfgajfasfafgafwba",
                "asfgahjfaf"
            ],
            "business": "aaa",
            "organization": "64fe7b4062f74d0007b46676"
        },
        "deleteAt": -1,
        "extend": {
            "funcName": "",
            "isNeedCreateIssue": false,
            "issueLevelUUID": "",
            "needRecoverIssue": false,
            "querylist": [
                {
                    "datasource": "dataflux",
                    "qtype": "dql",
                    "query": {
                        "alias": "",
                        "code": "Result",
                        "dataSource": "ssh",
                        "field": "ssh_check",
                        "fieldFunc": "count",
                        "fieldType": "float",
                        "funcList": [],
                        "groupBy": [
                            "host"
                        ],
                        "groupByTime": "",
                        "namespace": "metric",
                        "q": "M::`ssh`:(count(`ssh_check`)) BY `host`",
                        "type": "simple"
                    },
                    "uuid": "aada629a-672e-46f9-9503-8fd61065c382"
                }
            ],
            "rules": [
                {
                    "conditionLogic": "and",
                    "conditions": [
                        {
                            "alias": "Result",
                            "operands": [
                                "90"
                            ],
                            "operator": ">="
                        }
                    ],
                    "status": "critical"
                },
                {
                    "conditionLogic": "and",
                    "conditions": [
                        {
                            "alias": "Result",
                            "operands": [
                                "0"
                            ],
                            "operator": ">="
                        }
                    ],
                    "status": "error"
                }
            ]
        },
        "id": null,
        "isLocked": false,
        "jsonScript": {
            "atAccounts": [],
            "atNoDataAccounts": [],
            "channels": [],
            "checkerOpt": {
                "infoEvent": false,
                "rules": [
                    {
                        "conditionLogic": "and",
                        "conditions": [
                            {
                                "alias": "Result",
                                "operands": [
                                    "90"
                                ],
                                "operator": ">="
                            }
                        ],
                        "status": "critical"
                    },
                    {
                        "conditionLogic": "and",
                        "conditions": [
                            {
                                "alias": "Result",
                                "operands": [
                                    "0"
                                ],
                                "operator": ">="
                            }
                        ],
                        "status": "error"
                    }
                ]
            },
            "disableCheckEndTime": false,
            "every": "1m",
            "groupBy": [
                "host"
            ],
            "interval": 300,
            "message": ">Level：{{status}}  \n>Host：{{host}}  \n>Content：Host SSH Status {{ Result |  to_fixed(2) }}%  \n>Suggestion：Check Host SSH Service Status",
            "name": "Host {{ host }} SSH Service Exception-Add Alert Policy",
            "noDataMessage": "",
            "noDataTitle": "",
            "recoverNeedPeriodCount": 2,
            "targets": [
                {
                    "alias": "Result",
                    "dql": "M::`ssh`:(count(`ssh_check`)) BY `host`",
                    "qtype": "dql"
                }
            ],
            "title": "Host {{ host }} SSH Service Exception-Add Alert Policy",
            "type": "simpleCheck"
        },
        "monitorName": "default",
        "monitorUUID": "monitor_xxxx32",
        "refKey": "",
        "secret": "",
        "status": 0,
        "tagInfo": [],
        "type": "trigger",
        "updateAt": null,
        "updator": null,
        "uuid": "rul_xxxx32",
        "workspaceUUID": "wksp_xxxx32"
    },
    "errorCode": "",
    "message": "",
    "success": true,
    "traceId": "TRACE-014A6CF1-E9D8-4EA7-9527-D3C39CC3A94A"
}