Implementing observability practices and troubleshooting issues · Topic 4 of 6

Metrics Explorer, Dashboards, Alerting Policies and Notifications

Analyze metrics in Metrics Explorer, build and share dashboards with PromQL, set alerting policies on SLOs and cost, and route alerts to PagerDuty.

  • 5 min
In a nutshell
  • Metrics Explorer: filter, align, group, aggregate; PromQL is the recommended language.
  • Dashboards as JSON in Git; share through IAM on the scoping project; add playbooks.
  • Alerting policy = conditions + notification channels + documentation.

What it is

Metrics become useful when people can explore them, watch them on dashboards and be told when something needs action. Cloud Monitoring provides the Metrics Explorer, custom dashboards and alerting policies, with notification channels to email, chat and on-call tools.

Good alerting is about what users feel and what a person must do, not about every metric that moves.

Metrictime seriesMetrics Explorerfilter, group, alignDashboardshared viewAlerting policyconditionNotification channelPagerDuty, webhookOn callplaybook

How it works

Metrics Explorer

The Metrics Explorer charts any metric without building a dashboard first. You pick a metric and resource type, then shape the data.

StepWhat it does
FilterKeep only some time series, such as service_name = checkout
AlignmentTurn raw points into regular intervals, such as rate or mean per minute
Grouping and aggregationCombine series by a label, such as sum by region
Chart typeLine, stacked area, heatmap for distributions

Switch to the PromQL editor to write queries directly. PromQL is the recommended query language; MQL is deprecated, and new MQL charts and alerting policies can no longer be created in the console.

sum by (code) (rate(http_requests_total{namespace="shop"}[5m]))

Managing dashboards

TaskHow
CreateIn the console, from a Metrics Explorer chart, or as JSON with the API, gcloud or Terraform
FilterDashboard filters and variables, such as environment or cluster, applied to all charts
ShareDashboards live in the scoping project; access is through IAM roles such as Monitoring Viewer
PlaybooksText widgets with runbook steps and links next to the charts on-call engineers use
PromQLCharts can be defined with PromQL queries
gcloud monitoring dashboards create --config-from-file=checkout-dashboard.json

Keep dashboards as code in Git so they are reviewed and identical across environments. Google Cloud also provides predefined dashboards for many services.

Alerting policies

An alerting policy has one or more conditions, notification channels and documentation sent with the notification.

Condition typeExample
Metric thresholdp99 latency above 500 ms for 5 minutes
Metric absenceNo data from a job for 30 minutes
PromQLRatio of 5xx to all requests above 5%
SLO burn rateBudget burning 14.4 times faster than allowed over 1 hour
Log-based alertA specific log entry appears, such as a security event
Uptime or synthetic check failureProbe fails from several locations
displayName: Checkout 5xx ratio high
combiner: OR
conditions:
- displayName: 5xx above 5 percent for 5 minutes
  conditionPrometheusQueryLanguage:
    query: |
      sum(rate(http_requests_total{service="checkout",code=~"5.."}[5m]))
        / sum(rate(http_requests_total{service="checkout"}[5m])) > 0.05
    duration: 300s
    evaluationInterval: 60s
documentation:
  content: "Runbook: https://wiki.example.com/runbooks/checkout-5xx"
  mimeType: text/markdown
notificationChannels:
- projects/shop-prod/notificationChannels/1234567890

Prefer alerts on SLIs and SLO burn rate for paging; send cause-based alerts such as disk filling up as tickets. Use the duration setting to ignore brief spikes, and snooze alerts during planned work.

Alerting for cost control

Cost alerts come from Cloud Billing budgets, not Cloud Monitoring. A budget sends email at threshold percentages of actual or forecast spend and can publish to Pub/Sub, where a function can act, for example by stopping non-production resources.

Budgets alert; they do not cap spending by themselves.

Third-party alerting tools

ChannelUse
PagerDutyNative channel for on-call paging and escalation
WebhooksSend the alert JSON to any HTTP endpoint, such as Rootly or a custom incident bot
Pub/SubProgrammatic handling and fan-out
Slack, Google Chat, email, SMSTeam awareness

Gemini Cloud Assist for metrics

Gemini Cloud Assist can help interpret a chart or an alert in the console: summarizing what changed, suggesting related metrics and possible causes, and helping write queries. Confirm what it suggests against the data.

A worked example

On-call engineers get 200 pages a week, mostly CPU threshold alerts that need no action. The team replaces them with SLO burn rate alerts for availability and latency on the checkout and search services, routed to PagerDuty.

CPU and disk alerts become tickets through a webhook to the ticketing system. Every paging policy now has documentation linking to a playbook, and pages drop to about ten a week.

Too many pagesSLO burn rate alertsPagerDutyCause alertstickets via webhookPlaybook linksFewer, actionable pages

How the exam asks about this

  • "On-call engineers are paged by alerts that need no action." Page on SLO burn rate and user-facing symptoms; send cause-based alerts as tickets.
  • "Alerts must open incidents in PagerDuty." Add a PagerDuty notification channel to the alerting policy.
  • "Notify the team when monthly spend is forecast to exceed the plan." Create a Cloud Billing budget with forecast thresholds.

What to remember for the exam

  • Metrics Explorer: filter, align, group, aggregate; PromQL is the recommended language.
  • Dashboards as JSON in Git; share through IAM on the scoping project; add playbooks.
  • Alerting policy = conditions + notification channels + documentation.
  • Page on symptoms and SLO burn rate; ticket on causes.
  • Cost alerts come from Cloud Billing budgets, optionally to Pub/Sub for automation.
Watch out

A metric threshold condition with no duration fires on every momentary spike. Set a duration that matches how long the problem must last before a human should act.

Common mistakes

Paging on resource metrics. High CPU with healthy users needs no wake-up call. Page on user-facing symptoms.

Alerts with no documentation. On-call engineers then guess. Put the runbook link in the policy documentation.

Expecting a budget to stop spending. A budget only notifies. Automate a response through Pub/Sub if needed.

Check yourself

  • What are the three main parts of an alerting policy?

    Conditions that decide when it fires, notification channels that receive it, and documentation sent with the notification.

  • How do you send alerts to a tool with no native channel, such as Rootly?

    Use a webhook notification channel pointing at that tool's endpoint.

  • Where do cost alerts come from?

    Cloud Billing budgets, which notify at thresholds of actual or forecast spend and can publish to Pub/Sub.

Topic 4 of 6 in Implementing observability practices and troubleshooting issues

Test yourself on Implementing observability practices and troubleshooting issues

The full Google Cloud Professional Cloud DevOps Engineer question bank has 751 questions, with timed practice exams and an explanation for every answer.

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.