Placeholders
Overview
Placeholders are expressions that can be used to include details and context information in email messages, webhook notifications, scripts, and logging events.
Syntax
The placeholder is declared with the dollar sign $
and curly brackets {}
containing an expression.
${expression}
When the response action is triggered, the expression between the curly brackets is resolved to a concrete value based on the window context.
The replacements in the original input text, such as email subject, are performed in-place where each placeholder is substituted with the value of its expression, converted to a string.
The placeholder expression can refer to:
Window fields
Alert created for ${rule} with ${status}.
Entity and metric tags and fields
Incident registered in ${entity.tags.location}.
Literal values (constants) of different data types
Memory usage is too high ${value/1024}.
User-defined variables
Action executed by ${msg_user}.
Function results
Last message received on ${date_format(last_msg.timestamp)}.
Commonly used placeholders are listed in context cards for the editor fields where the placeholders are accepted.
Error Handling
Unknown fields and variables are evaluated to null
.
If the expression itself evaluates to null
, the placeholder is substituted with an empty string.
If the expression cannot be evaluated due to an error, the placeholder is left unchanged and an error message is presented on the Rule Errors page.
Examples
ActiveMQ on ${entity} recorded unauthorized connection from ${tags.remoteaddress}.
ActiveMQ on nurswgvml007 recorded unauthorized connection from 192.0.2.106.
Average CPU usage on ${entity} is high: ${round(avg()*100,1)}%
Average CPU usage on nurswgvml007 exceeds threshold: 70.2%
File System '${tags.file_system}' is low on disk space: ${value} (used)
File System '/opt/apps' is low on disk space: 95.567 (used)
Server ${entity.label}/${entity} located at site ${upper(entity.tags.location)} is shutting down.
Server Apps-NUR/nurswgvml007 located at site NUR is shutting down.