Loki Alert Rule Tester: Test your Loki alerting rules before they fire in production.
Runs in your browser — nothing you paste leaves this page. How we prove that
AlertLint playground
groups:
- name: ssh-security
rules:
# Fire when more than 5 failed SSH logins occur within 5 minutes.
- alert: HighAuthFailureRate
expr: sum(count_over_time({job="sshd"} |= "Failed password" [5m])) > 5
for: 0m
labels:
severity: warning
team: platform
annotations:
summary: "High rate of failed SSH logins"
description: "{{ $value }} failed SSH logins in the last 5 minutes."
rule_files:
- ssh-security.yml
evaluation_interval: 1m
tests:
- interval: 1m
input_streams:
- stream:
job: sshd
host: bastion-1
logs:
- "1m Failed password for root from 10.0.0.9 port 52344 ssh2"
- "2m Failed password for root from 10.0.0.9 port 52345 ssh2"
- "3m Failed password for admin from 10.0.0.9 port 52346 ssh2"
- "4m Failed password for admin from 10.0.0.9 port 52347 ssh2"
- "4m Failed password for git from 10.0.0.9 port 52348 ssh2"
- "5m Failed password for git from 10.0.0.9 port 52349 ssh2"
- "5m Accepted password for deploy from 10.0.0.2 port 60001 ssh2"
alert_rule_test:
- eval_time: 5m
alertname: HighAuthFailureRate
exp_alerts:
- exp_labels:
severity: warning
team: platform
exp_annotations:
summary: "High rate of failed SSH logins"
description: "6 failed SSH logins in the last 5 minutes."
Results update as you type — press ⌘/Ctrl + Enter to run now. Press Esc to release the editor.
Passed: HighAuthFailureRate
Fired 1 alert(s) with the expected labels and annotations.
AlertLint lets you test Loki alerting rules before production — paste your rules and synthetic logs, assert which alerts should fire, and get a pass or fail, all online with no install or signup.
The Gap
Loki has no promtool, so LogQL alerts ship untested.
Prometheus engineers have shipped tested alerting rules for years with promtool test rules — synthetic samples in, a pass or fail out. Loki adopted the same rule format but never shipped the test runner, so LogQL alerts have shipped untested: the only way to know whether a rule fired was to wait for production traffic.
The community has asked for this for years — see Loki issue #7655 and issue #16659. AlertLint closes that gap today: a free browser-based Loki alerting rule unit tester that uses the familiar promtool-style test file and runs entirely client-side.
New to the format? Jump to the two files or try the live playground above.
The Pipeline
How to test a Loki alert rule in your browser.
Five deterministic steps run end-to-end on every press of Run — all inside your browser tab, every time.
-
Parse the rules.
Your Loki ruler YAML is parsed into alerting and recording rule groups — the same shape the Loki ruler loads.
-
Parse the test file.
The promtool-modeled test file is read for its input log series, evaluation interval, and the alerts you expect.
-
Build an in-memory store.
Synthetic log lines are loaded into an ephemeral, in-browser log store so queries have something to read.
-
Evaluate the LogQL.
Each rule expression runs against the store at the test evaluation time, producing the alerts that would fire.
-
Diff against expected.
Actual alerts are diffed against your exp_alerts. Any mismatch is a failing case, reported inline.
File Formats
Two files, both familiar.
AlertLint reads exactly two inputs: your Loki ruler YAML and a promtool-modeled test file. If you have written either for Prometheus or Loki before, these will feel like home.
The rule file
Standard Loki ruler YAML — groups of alerting and recording rules, each with a LogQL expr, an optional for duration, and labels / annotations. This is the same file your ruler already loads.
groups:
- name: app-errors
rules:
- alert: HighErrorRate
expr: |
sum(count_over_time({app="checkout"} |= "error" [5m])) > 2
for: 2m
labels:
severity: page
annotations:
summary: "Checkout error rate is high"The test file
Modeled on promtool: input_streams of synthetic log streams, an evaluation interval, and an alert_rule_test listing the alerts you expect. An empty exp_alerts: [] asserts that no alert fires.
tests:
- interval: 1m
input_streams:
- stream:
app: checkout
logs:
- "1m level=error checkout upstream timeout"
- "2m level=error checkout upstream timeout"
- "3m level=error checkout upstream timeout"
- "4m level=error checkout upstream timeout"
- "5m level=error checkout upstream timeout"
- "6m level=error checkout upstream timeout"
alert_rule_test:
- eval_time: 6m
alertname: HighErrorRate
exp_alerts:
- exp_labels:
severity: page
exp_annotations:
summary: "Checkout error rate is high"
# Negative case — empty exp_alerts asserts NO alert fires.
- interval: 1m
input_streams:
- stream:
app: checkout
logs:
- "1m level=info checkout ok"
- "2m level=info checkout ok"
alert_rule_test:
- eval_time: 6m
alertname: HighErrorRate
exp_alerts: []Coming Soon
Run the same checks in CI.
The browser engine is step one. A drop-in CLI will run the identical assertions over a glob of test files in your pipeline, so a broken alert fails the build instead of paging you at 3 a.m.
A first-party GitHub Action that wraps the CLI is planned alongside it. Both are coming soon — the in-browser tester above works today.
# Coming soon — the same engine as a CLI
$ alertlint test ./tests/**.yaml
✓ app-errors › HighErrorRate (fires)
✓ app-errors › HighErrorRate (no-fire on info logs)
2 passed, 0 failedPreview Engine
Which LogQL the in-browser evaluator supports.
The evaluator covers the LogQL that alerting and recording rules are actually written in: stream selectors with =, !=, =~ and !~ label matchers, the four line filters (|=, !=, |~, !~), count_over_time and rate over a range, sum and sum by (…), and a threshold comparison. Anything outside that subset is reported as an error rather than guessed at, and a rule’s for: window is honored — the expression is re-sampled at the test interval across the whole hold window and every sample has to fire, so a rule that would still be Pending is never reported as Firing.
A note on accuracy: this is a preview engine. A full-parity build that compiles the upstream Loki query engine to WebAssembly is coming soon. Until then, treat a green run as strong pre-flight confidence rather than a byte-for-byte production replay.
FAQ
Questions, answered.
Tap a question to expand the answer.
What is AlertLint?
AlertLint is a free, browser-based unit tester for Grafana Loki alerting and recording rules. You paste your Loki ruler YAML plus a promtool-modeled test file with synthetic log streams, press Run, and AlertLint evaluates the LogQL and reports whether the alerts you expected actually fired. It is the promtool “test rules” equivalent that Loki never shipped.
Does my data ever leave my browser?
No. AlertLint runs 100% client-side. Your rules and synthetic logs are evaluated in your browser tab — nothing is uploaded to a server, and there is no account or signup. You can safely use it on internal or sensitive rule definitions.
How is this different from promtool?
Prometheus ships promtool test rules to unit-test alerting rules against synthetic samples. Loki has no built-in equivalent — there is no loki test command. AlertLint fills that gap for LogQL: you assert which alerts should fire from a given set of log lines, before the rules ever reach production.
Which LogQL features does the in-browser engine support?
The preview evaluator covers the common alerting and recording patterns — log and metric queries, stream selectors, label matchers, line filters, rate and count_over_time aggregations, sum aggregations, and threshold comparisons against expected alerts. Full parity with the upstream Loki query engine (compiled Go to WebAssembly) is planned for a future release.
Can I assert that no alert fires?
Yes. An empty exp_alerts list on a test case asserts that the rule produces no alerts at the evaluation time — the same negative-case semantics promtool uses. It is the canonical way to prove a rule will not fire on benign log volume.
Is AlertLint affiliated with Grafana Labs?
No. AlertLint is an independent, community tool and is not affiliated with or endorsed by Grafana Labs. Loki and Grafana are trademarks of Raintank, Inc. AlertLint models the promtool test-file format for familiarity and uses the vendor names only to describe what it tests.
How do I test Loki alerting rules before they reach production?
Before deploying, lint your rules YAML with lokitool rules lint or cortextool rules lint --backend=loki and dry-run your queries in Grafana Explore or logcli. For assertion-style pre-flight testing — the step those tools do not cover — paste your rules plus synthetic log streams into AlertLint and assert which alerts should fire, including negative cases. A green run gives strong pre-flight confidence, though the in-browser evaluator is a preview engine rather than a full production replay.
How is AlertLint different from lokitool and cortextool?
lokitool and cortextool offer rules lint and sync commands that validate rule structure and push rules to a Loki ruler — but neither runs synthetic-log alert assertions or tells you whether a rule fires. AlertLint brings the promtool-style, assertion-based workflow to LogQL: you supply synthetic log streams, declare which alerts you expect, and get a pass or fail verdict, entirely in the browser with no install.
How do I validate Loki ruler YAML online?
AlertLint parses standard Loki ruler YAML — groups of alerting and recording rules, each with a LogQL expr, optional for duration, and labels/annotations — and reports structural problems inline. For deeper expression-policy checks against rule metadata, promruval with --support-loki is a CLI option. AlertLint runs fully in the browser with no signup required.
More free, private DevOps tools.
AlertLint is one tool in OpsCanopy — a growing canopy of browser-based validators, converters and testers that never touch a server.
More in Observability
42 free tools, every one offline-capable — opscanopy.com works with no signup and nothing uploaded.
Author the upstream queries with the LogQL ↔ PromQL Helper and route the alerts downstream with the Alertmanager Route Tester, pair it with the now-live CVE-ignore converter and GitHub Actions validator, or browse the full tools directory.
Not affiliated with or endorsed by Grafana Labs. Loki and Grafana are trademarks of Raintank, Inc.