Implementing observability practices and troubleshooting issues · Topic 4 of 6
Metrics Explorer, Dashboards, Alerting Policies and Notifications
Analyze metrics in Metrics Explorer, build and share dashboards with PromQL, set alerting policies on SLOs and cost, and route alerts to PagerDuty.
- 5 min
- Metrics Explorer: filter, align, group, aggregate; PromQL is the recommended language.
- Dashboards as JSON in Git; share through IAM on the scoping project; add playbooks.
- Alerting policy = conditions + notification channels + documentation.
What it is
Metrics become useful when people can explore them, watch them on dashboards and be told when something needs action. Cloud Monitoring provides the Metrics Explorer, custom dashboards and alerting policies, with notification channels to email, chat and on-call tools.
Good alerting is about what users feel and what a person must do, not about every metric that moves.
How it works
Metrics Explorer
The Metrics Explorer charts any metric without building a dashboard first. You pick a metric and resource type, then shape the data.
| Step | What it does |
|---|---|
| Filter | Keep only some time series, such as service_name = checkout |
| Alignment | Turn raw points into regular intervals, such as rate or mean per minute |
| Grouping and aggregation | Combine series by a label, such as sum by region |
| Chart type | Line, stacked area, heatmap for distributions |
Switch to the PromQL editor to write queries directly. PromQL is the recommended query language; MQL is deprecated, and new MQL charts and alerting policies can no longer be created in the console.
sum by (code) (rate(http_requests_total{namespace="shop"}[5m]))
Managing dashboards
| Task | How |
|---|---|
| Create | In the console, from a Metrics Explorer chart, or as JSON with the API, gcloud or Terraform |
| Filter | Dashboard filters and variables, such as environment or cluster, applied to all charts |
| Share | Dashboards live in the scoping project; access is through IAM roles such as Monitoring Viewer |
| Playbooks | Text widgets with runbook steps and links next to the charts on-call engineers use |
| PromQL | Charts can be defined with PromQL queries |
gcloud monitoring dashboards create --config-from-file=checkout-dashboard.json
Keep dashboards as code in Git so they are reviewed and identical across environments. Google Cloud also provides predefined dashboards for many services.
Alerting policies
An alerting policy has one or more conditions, notification channels and documentation sent with the notification.
| Condition type | Example |
|---|---|
| Metric threshold | p99 latency above 500 ms for 5 minutes |
| Metric absence | No data from a job for 30 minutes |
| PromQL | Ratio of 5xx to all requests above 5% |
| SLO burn rate | Budget burning 14.4 times faster than allowed over 1 hour |
| Log-based alert | A specific log entry appears, such as a security event |
| Uptime or synthetic check failure | Probe fails from several locations |
displayName: Checkout 5xx ratio high
combiner: OR
conditions:
- displayName: 5xx above 5 percent for 5 minutes
conditionPrometheusQueryLanguage:
query: |
sum(rate(http_requests_total{service="checkout",code=~"5.."}[5m]))
/ sum(rate(http_requests_total{service="checkout"}[5m])) > 0.05
duration: 300s
evaluationInterval: 60s
documentation:
content: "Runbook: https://wiki.example.com/runbooks/checkout-5xx"
mimeType: text/markdown
notificationChannels:
- projects/shop-prod/notificationChannels/1234567890
Prefer alerts on SLIs and SLO burn rate for paging; send cause-based alerts such as disk filling up as tickets. Use the duration setting to ignore brief spikes, and snooze alerts during planned work.
Alerting for cost control
Cost alerts come from Cloud Billing budgets, not Cloud Monitoring. A budget sends email at threshold percentages of actual or forecast spend and can publish to Pub/Sub, where a function can act, for example by stopping non-production resources.
Budgets alert; they do not cap spending by themselves.
Third-party alerting tools
| Channel | Use |
|---|---|
| PagerDuty | Native channel for on-call paging and escalation |
| Webhooks | Send the alert JSON to any HTTP endpoint, such as Rootly or a custom incident bot |
| Pub/Sub | Programmatic handling and fan-out |
| Slack, Google Chat, email, SMS | Team awareness |
Gemini Cloud Assist for metrics
Gemini Cloud Assist can help interpret a chart or an alert in the console: summarizing what changed, suggesting related metrics and possible causes, and helping write queries. Confirm what it suggests against the data.
A worked example
On-call engineers get 200 pages a week, mostly CPU threshold alerts that need no action. The team replaces them with SLO burn rate alerts for availability and latency on the checkout and search services, routed to PagerDuty.
CPU and disk alerts become tickets through a webhook to the ticketing system. Every paging policy now has documentation linking to a playbook, and pages drop to about ten a week.
How the exam asks about this
- "On-call engineers are paged by alerts that need no action." Page on SLO burn rate and user-facing symptoms; send cause-based alerts as tickets.
- "Alerts must open incidents in PagerDuty." Add a PagerDuty notification channel to the alerting policy.
- "Notify the team when monthly spend is forecast to exceed the plan." Create a Cloud Billing budget with forecast thresholds.
What to remember for the exam
- Metrics Explorer: filter, align, group, aggregate; PromQL is the recommended language.
- Dashboards as JSON in Git; share through IAM on the scoping project; add playbooks.
- Alerting policy = conditions + notification channels + documentation.
- Page on symptoms and SLO burn rate; ticket on causes.
- Cost alerts come from Cloud Billing budgets, optionally to Pub/Sub for automation.
A metric threshold condition with no duration fires on every momentary spike. Set a duration that matches how long the problem must last before a human should act.
Common mistakes
Paging on resource metrics. High CPU with healthy users needs no wake-up call. Page on user-facing symptoms.
Alerts with no documentation. On-call engineers then guess. Put the runbook link in the policy documentation.
Expecting a budget to stop spending. A budget only notifies. Automate a response through Pub/Sub if needed.
Check yourself
What are the three main parts of an alerting policy?
Conditions that decide when it fires, notification channels that receive it, and documentation sent with the notification.
How do you send alerts to a tool with no native channel, such as Rootly?
Use a webhook notification channel pointing at that tool's endpoint.
Where do cost alerts come from?
Cloud Billing budgets, which notify at thresholds of actual or forecast spend and can publish to Pub/Sub.
Topic 4 of 6 in Implementing observability practices and troubleshooting issues
Test yourself on Implementing observability practices and troubleshooting issues
The full Google Cloud Professional Cloud DevOps Engineer question bank has 751 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.