Placeholders can be used to include contextual information in email messages, webhooks, scripts, and logging messages.


The placeholder is declared with the dollar sign $ and curly braces {}.


When the response action is triggered, the expression between the braces is resolved to a concrete value based on the window context.

The replacements in the original input text, such as email subject, are performed in-place where each placeholder is substituted with the value of its expression, converted to a string.

The expression can refer to:

Unknown fields and variables are evaluated to null.

If the expression itself evaluates to null, the placeholder is substituted with an empty string.

If the expression cannot be evaluated due to an error, the placeholder is left unchanged and an error message is presented on the Rule Errors page.


ActiveMQ on ${entity} recorded unauthorized connection from ${tags.remoteaddress}.
ActiveMQ on nurswgvml007 recorded unauthorized connection from

Average CPU usage on ${entity} is high: ${round(avg()*100,1)}%
Average CPU usage on nurswgvml007 exceeds threshold: 70.2%

File System '${tags.file_system}' is low on disk space: ${value} (used)
File System '/opt/apps' is low on disk space: 95.567 (used)

Server ${entity.label}/${entity} located at site ${upper(entity.tags.location)} is shutting down.
Server Apps-NUR/nurswgvml007 located at site NUR is shutting down.