Rule-based continuous diagnosing and alerting from application logs

One or more embodiments analyze log records of applications to determine whether a composite rule pertaining to events associated with the log records occurring within a specified time window are satisfied. Satisfaction of the composite rule may facilitate real-time diagnosis and detection of patterns in logs which indicate problems, threats, systemic issues, or performance issues relating to the applications. The composite rule may specify events associated with log records from multiple different applications that occur within a same specified time window and are associated with a same tenant and entity. Satisfaction of the composite rule may be analyzed by a state machine that tracks satisfaction of the individual rules within the composite rule in a sequence of stages. A notification, alert, or alarm may be generated when the composite rule is satisfied.