Axiom
Connect Axiom so monitor alerts open incidents in Ace, and Ace investigates them by querying your logs and events with APL.
Ace queries logs and events in the Axiom datasets you choose, with bounded APL over the incident window, and monitor alerts open incidents.
| Category | Logs |
| Ace reads | Event volume, text search and APL results in your datasets, and monitors and their notifications |
| Ace can change | Annotations on your datasets when an incident opens and resolves |
| Opens incidents | Yes, from monitor alerts |
| Setup | Settings form |
What Ace reads
Ace reads only the datasets you list and never reads or lists other datasets, including for the System Map. Each query runs on one dataset over the incident window and returns a limited number of rows, and Ace refuses a query that reaches another dataset, for example through a union, join or lookup.
- Event counts over time in one dataset, optionally split by a field.
- Case-insensitive text search, newest first.
- One APL pipeline over one dataset.
- Monitors on your datasets, with their query, threshold and the notifications they sent in the window.
What Ace can change
| Action | What it does | Approval | Undo |
|---|---|---|---|
| Annotation | When an incident opens or resolves, Ace adds one annotation to the connection's datasets so your charts show it, for example "Incident opened: <headline>" | Runs on its own | Yes. Undo from the incident deletes the annotation |
Ace adds annotations only after an admin turns on Allow Ace to update this tool during incidents for the connection. See Actions and approvals.
Ace can't check annotation permissions in advance, so Settings shows Shows when it runs: needs Annotations: create, delete, and a missing permission shows up only when Axiom refuses the update.
What opens an incident
Monitor alerts reach Ace through a custom webhook notifier as they fire. Ace doesn't poll Axiom, so nothing arrives until the notifier is set up.
- A notification with action Open opens a high-severity incident or joins the one already open on the workload, and Closed resolves it. Ace ignores other notifications.
- When Ace adds its notifier, it skips monitors with
ace:ignorein their name or description.
An alert opens an incident only when Axiom is routed to a workload. To route it, open the workload's settings, turn on Integration alerts under Investigation triggers and select Axiom under Alert sources.
Before you start
- The admin role in Ace. See Roles and permissions.
- Permission in Axiom to create API tokens.
You can't change a token's permissions later, so if you want alert wiring or annotations, add those permissions when you create the token.
Credentials and permissions
Ace uses one API token, with the permissions below.
| Credential | Where to create it | Permissions | Why Ace needs it |
|---|---|---|---|
| API token (required) | Settings > API tokens | Query on each dataset you list, and Datasets: read | Queries your datasets and lists them |
| Same token (only for alerts) | Monitors: read, update, and Notifiers: create, read, update, delete | Adds Ace's notifier to your monitors | |
| Same token (only for actions) | Annotations: create, delete | Adds and deletes incident annotations |
Set up
Create the API token
- In Axiom, open Settings > API tokens > New API token, name it Ace and set an expiration date.
- Under Token permissions, choose Advanced, then Custom, and add Query on each dataset Ace should read. Under Org level permissions, add Datasets: Read.
- If Ace should wire monitor alerts, add Monitors (read, update) and Notifiers (create, read, update, delete). For incident annotations, add Annotations (create, delete).
- Optionally set query cost limits, then create the token and copy it.
Connect Axiom in Ace
- In Ace, go to Settings > Data sources > Axiom.
- Fill in the form:
- API token: the token you copied.
- Organization ID (optional): required for personal tokens. Find it under Settings > General > ID, or after
app.axiom.co/in the app URL. - Datasets: the datasets Ace may read, comma-separated. List at least one.
- API URL (optional): only if you don't use
https://api.axiom.co. It must use HTTPS and be reachable from the public internet, because Ace doesn't connect to private or internal network addresses.
- Choose Connect Axiom. Ace saves the token only if it can see each dataset.
Wire alerts
If the token can manage monitors and notifiers, Ace creates a custom webhook notifier named ace-<id> and adds it to every monitor except those marked ace:ignore. Ace checks again every hour to pick up new monitors, and removes the notifier when you disconnect.
Adding a notifier resets a monitor's alert state
Axiom replaces a monitor when its notifiers change, so every monitor that gets Ace's notifier starts its alert state over.
To set it up yourself, choose Show manual setup in the Alerts section:
- Copy the webhook URL Ace shows.
- Choose Generate token and copy the token. Ace shows it once.
- In Axiom, open Monitors > Manage notifiers > New notifier, choose Custom webhook, enter the URL as the Webhook URL, add an
Authorizationheader ofBearer <token>and choose Create. - Add the notifier to the monitors that should open incidents.
Allow annotations (optional)
On the connected Axiom page, turn on Allow Ace to update this tool during incidents.
Confirm it's working
- The connection shows Connected and the number of datasets the token sees.
- The Alerts section shows Waiting for first event until the first delivery Ace accepts, then Verified.
Disconnect
- In Ace, go to Settings > Data sources > Axiom and choose Disconnect. Ace removes its notifier from your monitors and deletes it, and if it can't, it tells you so you can remove
ace-<id>in Axiom yourself. - In Axiom, delete the API token.
Next steps
- Actions and approvals: how observability updates and undo work.
- How Ace works: how alerts become incidents.
- Integrations: connect more data sources.