Formatting String
When alerting criteria are matched, an alert is raised and sent to a RESTful destination. Several types of RESTful plugins are available that take care of proper request formatting for the respective RESTful destinations. For example, some systems for alert management, such as Opsgenie or ServiceNow, require that alert severity is conveyed in some specific header fields and that the requests use a specific authentication method. What remains common for all such destinations is the human-readable alert body. The content of the alert-body is determined using a formatting string which is a parameter to every alert configuration.
If no special substitutions are used, the formatting string is printed "as is":
An alert was raised!
However a useful alert shall provide a context which allows to determine what caused the alert. The easiest way is to refer to elements of the "alert-event" using a jsonpath-plus expression enclosed in ${} as shown in the following example. The references will be replaced with the actual event part.
An alert was raised, severity ${alert.severity} full alert event here: ${$.} !
One can also refer to one of "metavariables": predefined expressions prefixed by a $ and enclosed in brackets. The names include:
$[NOW] -- alert processing timestamp
$[TIMESTAMP] -- timestamp of the alert-triggering event
An alert was raised at $[NOW]
Additional names create clickable links. The proper host name must be configured as the environment variable DomainAliasParameter.
$[ALERTLINK] -- link to the alert in alert dashboard
$[CAUSELINK] -- link to the alert in cause analysis dashboard
$[SUPPRESSLINK] -- clickable link to suppress generation of the alert for the respective key