Trigger

Trigger a flow when a Loki query returns new results

Polls Loki at regular intervals with a LogQL query and triggers a flow execution when new log entries matching the query are found. The trigger maintains state to track processed logs and only fires on new entries. Ideal for SecOps, SOAR, alerting, and monitoring use cases.

yaml
type: "io.kestra.plugin.grafana.loki.Trigger"

Examples

Trigger on security alerts

yaml
id: security_alert_handler
namespace: security

tasks:
  - id: handle_alert
    type: io.kestra.plugin.core.log.Log
    message: "Security alert: {{ trigger.count }} new entries detected"

  - id: process_logs
    type: io.kestra.plugin.core.log.Log
    message: "{{ trigger.logs }}"

triggers:
  - id: watch_security_logs
    type: io.kestra.plugin.grafana.loki.Trigger
    url: http://loki.example.com:3100
    authToken: "{{ secret('LOKI_TOKEN') }}"
    tenantId: production
    query: '{job="security", level="critical"} |= "unauthorized access"'
    interval: PT1M
    maxRecords: 100

Trigger on error patterns with authentication

yaml
id: error_monitor
namespace: monitoring

tasks:
  - id: send_alert
    type: io.kestra.plugin.notifications.slack.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": "🚨 {{ trigger.count }} errors detected",
        "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "*Query:* {{ trigger.query }}"
            }
          }
        ]
      }

triggers:
  - id: monitor_errors
    type: io.kestra.plugin.grafana.loki.Trigger
    url: https://loki.example.com:3100
    authToken: "{{ secret('LOKI_TOKEN') }}"
    tenantId: team-platform
    query: '{job="api", level="error"} |~ "timeout|connection refused"'
    interval: PT5M
    since: 10m

Trigger on payment failures (SOAR use case)

yaml
id: "trigger"
type: "io.kestra.plugin.grafana.loki.Trigger"
id: payment_failure_handler
namespace: payments

triggers:
  - id: watch_payment_failures
    type: io.kestra.plugin.grafana.loki.Trigger
    url: http://loki:3100
    tenantId: payments-team
    query: '{application="payment-gateway"} |= "payment failed" | json | amount > 1000'
    interval: PT30S
    maxRecords: 50
    since: 5m

tasks:
  - id: investigate
    type: io.kestra.plugin.core.log.Log
    message: "Investigating {{ trigger.count }} high-value payment failures"

Properties

query*string

LogQL query to monitor

The LogQL query to execute. When this query returns new results, the flow will be triggered.

url*string

Loki base URL

The base URL of your Loki instance (e.g., http://localhost: 3100 or https://logs.example.com)

authTokenstring

Authentication token

Bearer token for authentication if Loki is secured

conditions

List of conditions in order to limit the flow trigger.

Definitions

Condition to allow events between two specific datetime values.

type*object

afterstring

Formatdate-time

The date to test must be after this one.

beforestring

Formatdate-time

The date to test must be before this one.

Must be a valid ISO 8601 datetime with the zone identifier (use 'Z' for the default zone identifier).

datestring

Default{{ trigger.date }}

Condition to allow events on a particular day of the week.

dayOfWeek*string

Possible Values

MONDAYTUESDAYWEDNESDAYTHURSDAYFRIDAYSATURDAYSUNDAY

type*object

datestring

Default{{ trigger.date }}

Condition to execute tasks on a specific day of the week relative to the current month (first, last, ...)

dayInMonth*string

Possible Values

FIRSTLASTSECONDTHIRDFOURTH

Are you looking for the first or the last day in the month?

dayOfWeek*string

Possible Values

MONDAYTUESDAYWEDNESDAYTHURSDAYFRIDAYSATURDAYSUNDAY

The day of week.

type*object

datestring

Default{{ trigger.date }}

Condition for a specific flow of an execution.

flowId*string

namespace*string

type*object

Condition that checks labels of an execution.

labels*arrayobject

List of labels to match in the execution.

type*object

Condition for an execution namespace.

namespace*string

String against which to match the execution namespace depending on the provided comparison.

type*object

comparisonstring

Possible Values

EQUALSPREFIXSUFFIX

Comparison to use when checking if namespace matches. If not provided, it will use EQUALS by default.

prefixbooleanstring

Defaultfalse

Whether to look at the flow namespace by prefix. Shortcut for comparison: PREFIX.

Only used when comparison is not set

Condition based on the outputs of an upstream execution.

expression*booleanstring

type*object

Condition based on execution status.

type*object

inarray

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

notInarray

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

Condition based on variable expression.

expression*string

type*object

Condition for a specific flow. Note that this condition is deprecated, use `io.kestra.plugin.core.condition.ExecutionFlow` instead.

flowId*string

The flow id.

namespace*string

The namespace of the flow.

type*object

Condition for a flow namespace.

namespace*string

The namespace of the flow or the prefix if prefix is true.

type*object

prefixboolean

Defaultfalse

If we must look at the flow namespace by prefix (checked using startsWith). The prefix is case sensitive.

Condition that matches if any taskRun has retry attempts.

type*object

inarray

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of states that are authorized.

notInarray

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of states that aren't authorized.

Run a flow if the list of preconditions is met in a time window.

conditions*object

The list of preconditions to wait for

The key must be unique for a trigger because it will be used to store the previous evaluation result.

id*string

Validation RegExp^[a-zA-Z0-9][a-zA-Z0-9_-]*

Min length1

A unique id for the condition

type*object

resetOnSuccessboolean

Defaulttrue

Whether to reset the evaluation results of SLA conditions after a first successful evaluation within the given time period.

By default, after a successful evaluation of the set of SLA conditions, the evaluation result is reset, so, the same set of conditions needs to be successfully evaluated again in the same time period to trigger a new execution. This means that to create multiple executions, the same set of conditions needs to be evaluated to true multiple times. You can disable this by setting this property to false so that, within the same period, each time one of the conditions is satisfied again after a successful evaluation, it will trigger a new execution.

timeWindow

Default

{
  "type": "DURATION_WINDOW"
}

Define the time period (or window) for evaluating preconditions.

You can set the type of sla to one of the following values:

DURATION_WINDOW: this is the default type. It uses a start time (windowAdvance) and end time (window) that are moving forward to the next interval whenever the evaluation time reaches the end time, based on the defined duration window. For example, with a 1-day window (the default option: window: PT1D), the SLA conditions are always evaluated during 24h starting at midnight (i.e. at time 00: 00: 00) each day. If you set windowAdvance: PT6H, the window will start at 6 AM each day. If you set windowAdvance: PT6H and you also override the window property to PT6H, the window will start at 6 AM and last for 6 hours — as a result, Kestra will check the SLA conditions during the following time periods: 06: 00 to 12: 00, 12: 00 to 18: 00, 18: 00 to 00: 00, and 00: 00 to 06: 00, and so on.
SLIDING_WINDOW: this option also evaluates SLA conditions over a fixed time window, but it always goes backward from the current time. For example, a sliding window of 1 hour (window: PT1H) will evaluate executions for the past hour (so between now and one hour before now). It uses a default window of 1 day.
DAILY_TIME_DEADLINE: this option declares that some SLA conditions should be met "before a specific time in a day". With the string property deadline, you can configure a daily cutoff for checking conditions. For example, deadline: "09: 00: 00" means that the defined SLA conditions should be met from midnight until 9 AM each day; otherwise, the flow will not be triggered.
DAILY_TIME_WINDOW: this option declares that some SLA conditions should be met "within a given time range in a day". For example, a window from startTime: "06: 00: 00" to endTime: "09: 00: 00" evaluates executions within that interval each day. This option is particularly useful for declarative definition of freshness conditions when building data pipelines. For example, if you only need one successful execution within a given time range to guarantee that some data has been successfully refreshed in order for you to proceed with the next steps of your pipeline, this option can be more useful than a strict DAG-based approach. Usually, each failure in your flow would block the entire pipeline, whereas with this option, you can proceed with the next steps of the pipeline as soon as the data is successfully refreshed at least once within the given time range.

io.kestra.core.models.triggers.TimeWindow

deadlinestring

Formatpartial-time

SLA daily deadline

Use it only for DAILY_TIME_DEADLINE SLA.

endTimestring

Formatpartial-time

SLA daily end time

startTimestring

Formatpartial-time

SLA daily start time

Use it only for DAILY_TIME_WINDOW SLA.

typestring

DefaultDURATION_WINDOW

Possible Values

DAILY_TIME_DEADLINEDAILY_TIME_WINDOWDURATION_WINDOWSLIDING_WINDOW

The type of the SLA

The default SLA is a sliding window (DURATION_WINDOW) with a window of 24 hours.

windowstring

Formatduration

Use it only for DURATION_WINDOW or SLIDING_WINDOW SLA. See ISO_8601 Durations for more information of available duration value. The start of the window is always based on midnight except if you set windowAdvance parameter. Eg if you have a 10 minutes (PT10M) window, the first window will be 00: 00 to 00: 10 and a new window will be started each 10 minutes

windowAdvancestring

Formatduration

Use it only for DURATION_WINDOW SLA. Allow to specify the start time of the window Eg: you want a window of 6 hours (window=PT6H), by default the check will be done between: 00: 00 and 06: 00, 06: 00 and 12: 00, 12: 00 and 18: 00, and 18: 00 and 00: 00. If you want to check the window between 03: 00 and 09: 00, 09: 00 and 15: 00, 15: 00 and 21: 00, and 21: 00 and 3: 00, you will have to shift the window of 3 hours by settings windowAdvance: PT3H

windowstring

Formatduration

The duration of the window

Deprecated, use timeWindow.window instead.

windowAdvancestring

Formatduration

The window advance duration

Deprecated, use timeWindow.windowAdvance instead.

Condition to exclude other conditions.

conditions*

Min items1

The list of conditions to exclude.

If any condition is true, it will prevent the event's execution.

type*object

Condition to have at least one condition validated.

conditions*

Min items1

The list of conditions to validate.

If any condition is true, it will allow the event's execution.

type*object

Condition to allow events on public holidays.

type*object

countrystring

ISO 3166-1 alpha-2 country code. If not set, it uses the country code from the default locale.

datestring

Default{{ trigger.date}}

subDivisionstring

ISO 3166-2 country subdivision (e.g., provinces and states) code.

It uses the Jollyday library for public holiday calendar that supports more than 70 countries.

Condition to allow events between two specific times.

type*object

afterstring

Formattime

The time to test must be after this one.

beforestring

Formattime

The time to test must be before this one.

Must be a valid ISO 8601 time with offset.

datestring

Default{{ trigger.date }}

The time to test.

Can be any variable or any valid ISO 8601 time. By default, it will use the trigger date.

Condition to allow events on weekend.

type*object

datestring

Default{{ trigger.date }}

The date to test.

Can be any variable or any valid ISO 8601 datetime. By default, it will use the trigger date.

connectTimeoutintegerstring

Default30

Connection timeout

HTTP connection timeout in seconds

intervalstring

DefaultPT1M

Formatduration

Polling interval

How often to check for new logs. Defaults to every 1 minute.

maxRecordsintegerstring

Default100

Maximum records per trigger

Maximum number of log entries to return per trigger execution. Defaults to 100.

readTimeoutintegerstring

Default60

Read timeout

HTTP read timeout in seconds

sincestring

Default10m

Lookback window

Time window to look back for logs on first run (e.g., '1h', '30m', '1d'). Defaults to 10 minutes.

stateKeystring

Custom state key

Custom key for storing trigger state. If not provided, defaults to namespace.flow_id.trigger_id

stateTtlstring

DefaultPT24H

Formatduration

State TTL

Time to live for the trigger state. After this duration, the state will be cleared. Defaults to 1 day.

stopAfterarray

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of execution states after which a trigger should be stopped (a.k.a. disabled).

tenantIdstring

Grafana Loki Tenant ID

X-Scope-OrgID header value for multi-tenant Loki setups

Outputs

countinteger

Number of new log entries

Total count of logs that matched the query since last check

lastTimestampstring

Latest timestamp

Timestamp of the most recent log entry (in nanoseconds)

logsarray

SubTypeobject

List of new log entries that triggered the flow

Each entry contains timestamp, labels, and log line or metric value

querystring

Query executed

The LogQL query that was executed

resultTypestring

Result type

Type of result returned by Loki (streams, matrix, or vector)

Core Plugins and tasks

Tasks that provide Kestra's built-in orchestration, I/O, and observability capabilities.

CoreStorageScript

DBT

Integrate dbt data transformations into Kestra orchestration pipelines.

Tool

Azure

Leverage Microsoft Azure services within Kestra data workflows.

CloudMessagingStorageBatchTool

Trigger

More Plugins in this Category

Core Plugins and tasks

DBT

Azure