Learn how to customize how events display in charts.

Examining events directly in charts can help you correlate metric anomalies with the events. This page explains how you can display an event overlay with details about the event, and customize the overlay.

Event Overlay Example

The example below shows an event overlay that includes a link to the alert that generated it and other information about the event.

Events queries

Event Overlay Types and Color

Different events display in different ways:

  • If a single event occurs in a time interval, the event icon displays as a dot on the chart’s X-axis.
  • If two or more events occur in a time interval, the event icon displays as a star on the X-axis.
  • Instantaneous events display a vertical line and non-instantaneous or ongoing events display a shaded region that represents the duration of the event. 

Event overlay

The event severity determines the color of the overlay:

  • SEVERE - red
  • WARN - orange
  • SMOKE - gray
  • INFO - blue

Control Event Overlays

Events can make your charts look cluttered. There are several options to control what’s shown on a chart:

  • Options for individual charts
  • Options that apply to the whole dashboard

Configure Event Overlays for Individual Charts

There can be alert generated system events, or events that are manually created by a user. For details, see Event Sources and Types. You can configure a chart to show specific events.

Action Results
Display events based on source events:
Select the Display Source Events checkbox in the chart’s’ Format tab to display events related to alerts that fired for sources in the chart.

For example, if the query used in the chart uses metrics that have the application source tag, and these applications have events related to alerts that fired, you see these marked on the chart. See Metric Data Format for details.
Select display source events
Add an events() query to view specific events on a chart:
Add an events() query to the chart. An events() query cannot be the only query on a chart. At least one ts() query must be enabled on the chart so that the events() query results display.

For example, events(name="Latency Alert" and type="alert") shows all the warning events on your chart.
Add an events query to the chart

Specify an Events() Query for a Dashboard

Action Results
Set an events() query in dashboard preferences, which you can access using the ellipsis menu in the top right corner of the dashboard.

For example, events(name="High CPU Usage") shows events that have the name High CPU Usage on all the charts of the dashboard.
Add an events query to the dashboard settings

View Events on Dashboards and Charts

Let’s look at how you can view the events you added to the charts and dashboards in the above examples using the Show Events dropdown in the middle of the time bar.

Show Events Options Results
From Chart: Displays events based on the selection of the Display Source Events checkbox (default setting) and the events() query in a chart.
From Dashboard Settings: Displays events based on the events() query specified in dashboard settings. The source events are not displayed in this option.
From Chart & Dashboard: Displays events based on the selection of the Display Source Events checkbox and the global events() query specified in dashboard settings.
Related Source Alerts: Displays the events that were generated by alerts associated with sources of the charts.
All: Displays all events that have occurred within the time window associated with the chart windows.
None: Hides all events from every chart in the dashboard.