CEL expression that returned monitors must match. Must evaluate to
bool, and must be URL-encoded.
Only the fields below are filterable. An expression that fails to
compile, or that references anything outside this table, is rejected
with 400; the field set is fixed, so retrying with a different
spelling will not succeed. createdBy.name is a common example of a
reference that is rejected — only .id is exposed on a user.
| Field | CEL type | Notes |
|---|
id | int | Compare unquoted, even though id serializes as a string in JSON. The default ordering. |
name | string | Supports matches() for an RE2 regex. |
label | string | Deprecated alias of name. |
description | string | Supports matches(). Compare against "" for "no description" — the response renders it as null, but the filter sees the empty string. |
disabled | bool | Turned off by a user, or by a limit. |
ruleKind | string | A MonitorRuleKind value, e.g. "Threshold". |
aiTriagingMode | string | A MonitorAiTriagingMode value. "Triage" is the enabled state the list's AI auto-investigate column shows. |
createdAt | timestamp | Use timestamp("2026-01-01T00:00:00Z") to compare. |
updatedAt | timestamp | |
createdBy.id | int | Id of the creating user. |
updatedBy.id | int | Id of the last user to update it. |
managedBy.id | int | Id of the managing app. Null when no app manages it. |
managed | bool | Whether an app manages this monitor. managed == false selects the user-managed monitors, which managedBy.id == null cannot express. |
scheduled | bool | Whether it runs on its own schedule. |
disabledCause | string | A MonitorDisabledCause value, e.g. "AlertRateLimit". Null while enabled. |
governorState | string | A MonitorGovernorState value: "Normal", "GracePeriod" or "CostDisabled". Null when no spend limit is configured. |
rollupStatus | string | A MonitorRollupStatus value: the outcome of the monitor's own last run. Not every documented value is reachable — see the note below. |
health | string | A MonitorHealth value: one rollup of run outcome, disabled cause, spend-limit state and cluster failover state. This is the value the list's Health column shows. Not every documented value is reachable — see the note below. |
alertState | string | A MonitorAlertState value: "Triggering", "Previous" or "Never". |
muteState | string | A MonitorMuteState value. |
muteCount | int | Number of mute rules covering the monitor; 0 when unmuted. |
mutedUntil | timestamp | Null when not muted, or muted indefinitely. |
lastAlarmTime | timestamp | Null if it has never alerted. |
lastErrorTime | timestamp | Null if it has never logged a fatal error. |
lastWarnTime | timestamp | Null if it has never warned. |
objectTags | map(string, list(string)) | The monitor's object tags, each key mapped to its values. See the note below. |
Comparisons combine with && and ||. A nullable field is compared
with == null / != null; write the field on the left, since
null == lastAlarmTime is not recognised as a null check.
objectTags supports a key test ("team" in objectTags), a value
test ("sre" in objectTags["team"]), exists(), all() and
exists_one() over a key's values or over the keys
(objectTags.exists(k, k.startsWith("team"))), and
("team" in objectTags ? objectTags["team"] : []) as the list a
comprehension iterates. The key in a key test or an index must be a
string literal. Reading a key the monitor does not have is an error,
which matches no monitor. Other uses, such as size(), comparing a
key's values or the whole map, or filter() and map() over a key's
values, are rejected with 400.
When filter is used together with the deprecated nameExact or
nameSubstring parameters, every condition must match.
