Introduction to the alert template that you must configure when you create an action policy - Simple Log Service

This topic describes the variables that are available for use in the new version of alert templates. This topic also describes the methods that you can use to reference the variables.

Reference methods

Important

You must reference variables by using the full names of the variables. If a referenced variable cannot be found or is invalid, Simple Log Service replaces the variable with an empty string. If the value of a referenced variable is of the object type, the value is converted to a JSON string. Make sure that the name of a variable conforms to the following rules: The name must contain letters, digits, and underscores. The name cannot start with a digit.

If a variable name conforms to the rules, reference the variable in the {{alert.xxx}} format.
If a variable name does not conform to the rules, reference the variable name in a different format. For example, if you want to reference the __tag__:__namespace__ variable, use {{alert.annotations["__tag__:__namespace__"] }}.

When you configure an action policy, you must select an alert template. The alert template specifies the content and subject of alert notifications. When you configure the Content and Subject parameters for an alert template, you can reference variables in the {{ alert.xxx }} format. Before Simple Log Service sends an alert notification, Simple Log Service replaces the variables that are referenced in the Content and Subject parameters with the actual values. For example, Simple Log Service replaces {{ alert.project }} with the name of the project to which the configured alert rule belongs.

You can also use control flows and built-in functions to manipulate and process variables. For more information about the syntax and built-in functions that are supported by the new version of alert templates, see Syntax for new alert templates and Built-in functions in alert templates.

Alert attributes

Variable	Description	Type	Value example	Reference example
aliuid	The ID of the Alibaba Cloud account to which the project belongs.	string	117918634953****	`The project in which the alert is triggered belongs to the Alibaba Cloud account {{ alert.aliuid }}.`
alert_instance_id	The execution ID of the alert that is triggered.	string	ee16a8f435485f3f-5be6b81edc520-3d6****	The execution ID of the alert that is triggered is `{{ alert.alert_instance_id }}`.
alert_id	The ID of the alert rule. Each alert rule must have a unique ID in the project to which the alert rule belongs.	string	alert-12345	The ID of the alert rule is `{{ alert.alert_id }}`.
alert_name	The name of the alert rule.	string	Test alert rule	The name of the alert rule based on which the alert is triggered is `{{ alert.alert_name }}`.
alert_type	The type of the alert. sls_alert: The alert is triggered based on an alert rule in Simple Log Service. sls_pub: The alert is ingested from an alerting system rather than Simple Log Service. sls_ml: The alert is triggered by intelligent inspection in Simple Log Service.	string	sls_alert	The type of the alert is `{{ alert.alert_type }}`, which is converted to `{{ alert.alert_type \| format_type }}`.
region	The region.	string	cn-hangzhou	The alert is triggered in the `{{ alert.region }}` region.
project	The project to which the alert rule belongs.	string	my-project	The alert rule based on which the alert is triggered belongs to the `{{ alert.project }}` project.
next_eval_interval	The length of time before the next evaluation activity starts. Unit: seconds.	int	300	The next evaluation activity starts after `{{ alert.next_eval_interval }}` seconds.
alert_time	The time at which the current evaluation activity starts.	int	1616744734	The current evaluation activity starts at `{{ alert.alert_time }}`, which is converted to `{{ alert.alert_time \| format_date }}`.
fire_time	The time at which the alert is triggered for the first time.	int	1616059834	The alert is triggered at `{{ alert.fire_time }}` for the first time, which is converted to `{{ alert.fire_time \| format_date }}`.
status	The status of the alert. firing: The alert is triggered. resolved: The alert is cleared.	string	firing	The status of the alert is `{{ alert.status }}`, which is converted to `{{ alert.status \| format_status }}`.
resolve_time	The time at which the alert is cleared. If the alert is in the firing state, the value is 0. If the alert is in the resolved state, the value is the point in time at which the alert is cleared.	int	0	The alert is cleared at `{{ alert.resolve_time }}`, which is converted to `{{ alert.resolve_time \| format_date }}`.
severity	The severity level of the alert. 10: Critical 8: High 6: Medium 4: Low 2: Report	int	10	The severity level of the alert is `{{ alert.severity }}`, which is converted to `{{ alert.severity \| format_severity }}`.
labels	The labels of the alert.	map	{"env":"test"}	The labels of the alert are `{{ alert.labels \| to_list }}`.
annotations	The annotations of the alert.	map	{ "title": "Alert title","desc": "Alert description" }	The annotations of the alert are `{{ alert.annotations \| to_list }}`.
results	The parameters and intermediate results that are returned. The value of this variable is an array. For more information about the value of this variable, see QueryData structure.	array	See the "Appendix" section at the end of this topic.	The first query starts at `{{ alert.results[0].start_time }}` and ends at `{{ alert.results[0].end_time }}`. The value of the count variable is `{{ alert.results[0].fire_result.cnt }}`. The query statement is `{{ alert.results[0].query }}`.
fire_results	The data records for which the alert is triggered. Up to 100 data records can be returned in response to a set operation on data. If the value of fire_results exceeds 2 KB in size and the value of a single query result field exceeds 1 KB in size, the value of fire_results is truncated, and the excess part is discarded.	array	See the "Appendix" section at the end of this topic.	The alert is triggered for the following data records: `{{ alert.fire_results \| to_json }}`.
fire_results_count	The total number of data records for which the alert is triggered. The value of this variable may be greater than 100. For example, if you perform a CROSS JOIN operation on data, Simple Log Service may trigger an alert for more than 100 data records.	int	3	The alert is triggered for a total of `{{ alert.fire_results_count }}` data records.
condition	The trigger condition based on which the alert is triggered. The condition is an expression. Simple Log Service replaces the variables in the trigger condition with the values that trigger the alert. Each value is enclosed in a pair of brackets []. The value of this variable is in the `Count:Quantity expression;Condition:Matching expression` format.	string	`Count:[5] > 3;Condition:[example.com]=='example.com'`	The trigger condition based on which the alert is triggered is `{{ alert.condition }}`.
raw_condition	The original trigger condition. The variables in the trigger condition are not replaced. The value of this variable is in the `Count:Quantity expression;Condition:Matching expression` format.	string	`Count:__count__ > 3;Condition:host=='example.com'`	The original trigger condition is `{{ alert.raw_condition }}`.
policy	The ID of the alert policy or action policy. For more information about the value of this variable, see Policy structure.	map	See the "Appendix" section at the end of this topic.	The ID of the alert policy is `{{ alert.policy.alert_policy_id }}`.
dashboard	The name of the dashboard that is associated with the alert.	string	mydashboard	The name of the dashboard that is associated with the alert is `{{ alert.dashboard }}`.
alert_url	The URL of the details page of the alert.	string	https://sls.console.aliyun.com/lognext/project/test-xxxx/alert/alert-1617164106-940166	The URL of the details page of the alert is `{{ alert.alert_url }}`.
query_url	The URL of the source web page that is accessed for the first query.	string	https://sls.console.aliyun.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcyBjbn****&queryTimeType=99&startTime=1617175089	The URL of the source web page that is accessed for the first query is `{{ alert.query_url }}`.
alert_history_dashboard_url	The URL of the Alert History Statistics dashboard.	string	https://sls.console.aliyun.com/lognext/project/test-xx/dashboard/internal-alert-analysis	The URL of the Alert History Statistics dashboard is `{{ alert.alert_history_dashboard_url }}`.
dashboard_url	The URL of the dashboard that is associated with the alert.	string	https://sls.console.aliyun.com/next/project/myproject/dashboard/mydashboard	The URL of the dashboard that is associated with the alert is `{{ alert.dashboard_url }}`.
fingerprint	The fingerprint of the alert. For more information, see Deduplicate alerts based on fingerprints.	string	478325709134bc5c	The fingerprint of the alert is `{{ alert.fingerprint }}`.
signin_url	The URL of the page on which you can view the details of the alert without the need to log on to the Simple Log Service console. For more information, see View alert details in logon-free mode.	string	https://sls.console.aliyun.com/console/AlertAjax/slsSignIn.json?token=xxxx	`[View Details]({{ alert.signin_url }})`

Policy structure

The following table describes the variables that can be referenced in the policy variable.

Variable	Description	Type	Value example
alert_policy_id	The ID of the alert policy	string	sls.test-alert
action_policy_id	The ID of the action policy that you configure in the alert rule. This variable is available only when you select Dynamic Action Policy for the alert policy.	string	sls.test-action
repeat_interval	The period during which the action policy is executed only once and Simple Log Service sends only one alert notification if duplicate alerts are triggered. This variable is available only when you select Dynamic Action Policy for the alert policy.	string	4h

QueryData structure

The following table describes the variables that can be referenced in the results variable.

Variable	Description	Type	Value example
store_type	The storage type. log: log data metric: metric data meta: resource data	string	log
region	The region where the destination Logstore or Metricstore resides. If the value of the store_type variable is meta, this variable is empty.	string	cn-hangzhou
project	The project to which the destination Logstore or Metricstore belongs. If the value of the store_type variable is meta, this variable is empty.	string	sls-test-alert
store	The name of the destination Logstore or Metricstore.	string	test-logstore
query	The query statement.	string	error \| select count(1) as cnt
start_time	The beginning of the time range to query. If the value of the store_type variable is meta, this variable is empty.	int	1616741485
end_time	The end of the time range to query. If the value of the store_type variable is meta, this variable is empty.	int	1616745085
raw_results	The data records that are queried. The value of this variable is an array. Up to 100 data records can be returned. If the value of raw_results exceeds 2 KB in size and the value of a single query result field exceeds 1 KB in size, the value of raw_results is truncated, and the excess part is discarded.	array	`[{ "host": "example.com", "slbid": "slb-02", "status": "200" }, { "host": "example.com", "slbid": "slb-01", "status": "200" }]`
raw_results_count	The number of data records that are queried. The number can be greater than 100.	int	20
fire_result	The first data record among the data records for which the alert is triggered. The result set for which the alert is triggered may contain multiple data records. Simple Log Service returns only the first data record of the result set for this variable.	map	`{ "host": "example.com", "slbid": "slb-02", "status": "200" }`
query_url	The URL of the data records that are queried. If the value of the store_type variable is meta, this variable is empty.	string	https://sls.console.aliyun.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcy*******&queryTimeType=99&startTime=1617175089
dashboard_url	The URL of the dashboard that is associated with the query.	string	https://sls.console.aliyun.com/next/project/myproject/dashboard/mydashboard
role_arn	The Alibaba Cloud Resource Name (ARN) of the service role that is used.	string	acs:ram::117918634953****:role/aliyunslsalertmonitorrole

FAQ

Appendix

results

[{
    "store_type": "log",
    "region": "cn-hangzhou",
    "project": "sls-alert-test",
    "store": "test",
    "query": "* | select count(1) as cnt",
    "start_time": 1616741485,
    "end_time": 1616745085,
    "dashboard_id": "mydashboard",
    "raw_results": [{
        "cnt": "4"
    }],
    "raw_result_count": 1,
    "fire_result": {
        "cnt": "4"
    },
    "truncated": false,
    "role_arn": ""
}]

fire_results

[{
    "host": "example.com",
    "host__1": "example.com",
    "pv": "836",
    "slbid": "slb-02",
    "status": "200"
}, {
    "host": "example.com",
    "host__1": "example.com",
    "pv": "836",
    "slbid": "slb-02",
    "status": "200"
}]

policy

{
    "alert_policy_id": "sls.test-alert",
    "action_policy_id": "sls.test-action",
    "repeat_interval": "5m0s"
}