Placeholders are expressions that can be used to include details and context information in email messages, webhook notifications, scripts, and logging events.


The placeholder is declared with the dollar sign $ and curly brackets {} containing an expression.


When the response action is triggered, the expression between the curly brackets is resolved to a concrete value based on the window context.

The replacements in the original input text, such as email subject, are performed in-place where each placeholder is substituted with the value of its expression, converted to a string.

The placeholder expression can refer to:

  • Window fields

    Alert created for ${rule} with ${status}.

  • Entity and metric tags and fields

    Incident registered in ${entity.tags.location}.

  • Literal values (constants) of different data types

    Memory usage is too high ${value/1024}.

  • User-defined variables

    Action executed by ${msg_user}.

  • Function results

    Last message received on ${date_format(last_msg.timestamp)}.

Commonly used placeholders are listed in context cards for the editor fields where the placeholders are accepted.

Error Handling

Unknown fields and variables are evaluated to null.

If the expression itself evaluates to null, the placeholder is substituted with an empty string.

If the expression cannot be evaluated due to an error, the placeholder is left unchanged and an error message is presented on the Rule Errors page.


ActiveMQ on ${entity} recorded unauthorized connection from ${tags.remoteaddress}.
ActiveMQ on nurswgvml007 recorded unauthorized connection from

Average CPU usage on ${entity} is high: ${round(avg()*100,1)}%
Average CPU usage on nurswgvml007 exceeds threshold: 70.2%

File System '${tags.file_system}' is low on disk space: ${value} (used)
File System '/opt/apps' is low on disk space: 95.567 (used)

Server ${entity.label}/${entity} located at site ${upper(entity.tags.location)} is shutting down.
Server Apps-NUR/nurswgvml007 located at site NUR is shutting down.