This topic describes template variables that are supported in alert notifications and the methods used to reference the variables.

Reference methods

When you configure an action policy, you must select an alert template. The template is used to define the content and subject of alert notifications. When you specify the Content and Subject parameters, you can use the ${fieldName} syntax to reference a template variable. Log Service replaces the template variables that are referenced in the Content and Subject parameters with the actual values before Log Service sends an alert notification. For example, Log Service replaces ${project} with the name of the project to which the alert monitoring rule belongs.
Notice You must reference variables by using exact matches. If a referenced variable does not exist or is invalid, Log Service processes the variable as an empty string. If the value of a referenced variable is of the object type, the value is converted and displayed as a JSON string.

Available variables and reference examples

The following table describes the supported template variables and the methods used to reference the variables.
Variable Description Sample value Reference example
aliuid The ID of the Alibaba Cloud account to which a project belongs. 1234567890 An alert is triggered for the Alibaba Cloud account ${aliuid}.
alert_instance_id The ID of an alert. ee16a8f435485f3f-5be6b81edc520-3d69233 The ID of the alert is ${alert_instance_id}.
project The project to which an alert monitoring rule belongs. my-project An alert is triggered in the ${project} project.
alert_id The ID of an alert monitoring rule. The ID is unique in a project. 0fdd88063a611aa114938f9371daeeb6-1671a52eb23 The ID of the alert monitoring rule is ${alert_id}.
alert_type
  • sls_alert: The alert is triggered based on an alert monitoring rule.
  • sls_pub: The alert belongs to the alert ingestion system.
sls_alert The alert type is ${alert_type}.
alert_name The name of an alert monitoring rule. new2 An alert is triggered based on an alert monitoring rule named ${alert_name}.
next_eval_interval The interval before the next evaluation. 900 The next evaluation is performed ${next_eval_interval} seconds later.
alert_time The time when the evaluation is performed. 1616744734 The evaluation is performed at ${alert_time}.
fire_time The time when the first alert is triggered. 1616059834 The first alert is triggered at ${fire_time}.
status The status of an alert. Valid values: firing and resolved. firing The alert status is ${status}.
resolve_time The time when an alert is cleared.
  • If the alert status is firing, the value of this variable is 0.
  • If the alert status is resolved, the value of this variable is a specific time.
0 The alert is cleared at ${resolve_time}.
results The parameters and results of a query. The variable is of the array type. For information about the fields in the results variable, see Data structure of the results variable.
[
{
"store_type": "log",
"region": "cn-hangzhou",
"project": "sls-alert-test",
"store": "test",
"query": "* | select count(1) as cnt",
"start_time": 1616741485,
"end_time": 1616745085,
"dashboard_id": "mydashboard",
"raw_results": [{"cnt": "4"}],
"raw_result_count": 1,
"fire_result": {"cnt": "4"},
"truncated": false,
"role_arn": ""
}
]
The time range of the first query statement is from ${results[0].start_time} to ${results[0].end_time}. The value of the count field is ${results[0].fire_result.count}.
Note In this example, 0 indicates the serial number of a query statement. The serial number of a query statement is the same as the serial number of the chart that shows the result of the query statement. For more information, see How can I view the serial number of a chart?
labels The list of labels. {"env":"test"} The alert label is ${labels}.
annotations The list of annotations. { "title": "Alert title","desc": "Alert description"} The alert annotation is ${annotations}.
severity The severity level of an alert. Valid values: 10 (Critical), 8 (High), 6 (Medium), 4 (Low), and 2 (Report). 10 The alert severity level is ${severity}.
policy The alert policy or action policy. For information about the fields in the policy variable, see Data structure of the policy variable.
{"alert_policy_id": "sls.test-alert","action_policy_id": "sls.test-action","use_default": false,"repeat_interval": "6m0s"}
The ID of the alert policy is ${policy.alert_policy_id}.
region The region to which an alert monitoring rule belongs. cn-hangzhou The region to which the alert monitoring rule belongs is ${region}.
drill_down_query The query statement that is used for drill-down analysis. This value is empty for custom alert templates. The variable can be used for the alert templates of Log Audit Service, Cost Manager, and SLB Log Center. * | select count(1) as cnt None
alert_url The URL of an alert. https://sls.console.aliyun.com/lognext/project/test-xxxx/alert/alert-1617164106-940166 The alert URL is ${alert_url}.
query_url The URL of the first query page in query statistics. https://sls-stg.console.aliyun.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcyBjbnQ%3D&queryTimeType=99&startTime=1617175089 The URL of the first query page in query statistics is ${query_url}.
alert_history_dashboard_url The URL of an Alert History Statistics dashboard. https://sls.console.aliyun.com/lognext/project/test-xx/dashboard/internal-alert-analysis The URL of the Alert History Statistics dashboard is ${alert_history_dashboard_url}.
condition The trigger condition of an alert monitoring rule. Log Service replaces the variables in the trigger condition with the values that trigger an alert. Each value is enclosed in a pair of brackets []. Format: Count: quantity expression; Condition: matching expression. Count:[5] > 3;Condition:[www.mro.mock.com]=='www.mro.mock.com' The trigger condition of the alert monitoring rule is ${condition}.
raw_condition The original trigger condition of the alert monitoring rule. Variables in the trigger condition are retained. Format: Count: quantity expression; Condition: matching expression. Count:__count__ > 3;Condition:host=='www.mro.mock.com' The original trigger condition is ${raw_condition}.
dashboard The name of the dashboard that is associated with an alert monitoring rule. mydashboard The alert monitoring rule is associated with a dashboard named ${dashboard}.
dashboard_url The URL of the dashboard that is associated with an alert monitoring rule. https://sls.console.aliyun.com/next/project/myproject/dashboard/mydashboard The URL of the dashboard associated with the alert monitoring rule is ${dashboard_url}.
fire_results The data that triggers an alert. Up to 100 rows of data are returned after set operations are peroformed. [{"host":"www.xhu.mock.com","host__1":"www.iks.mock.com","pv":"836","slbid":"slb-02","status":"200"},{"host":"www.ykw.mock.com","host__1":"www.iks.mock.com","pv":"836","slbid":"slb-02","status":"200"},{"host":"www.mro.mock.com","host__1":"www.iks.mock.com","pv":"836","slbid":"slb-02","status":"200"},{"host":"www.amh.mock.com","host__1":"www.iks.mock.com","pv":"836","slbid":"slb-02","status":"200"},{"host":"www.uua.mock.com","host__1":"www.ue.mock.com","pv":"780","slbid":"slb-01","status":"200"}] The data that triggers the alert is ${fire_results}.
fire_results_count The total number of rows of data that triggers an alert. The value can be greater than 100. For example, if you perform the CROSS JOIN operation on multiple data sets, the total number of rows of data that triggers an alert can be greater than 100. 3 The total number of rows of data that triggers the alert is ${fire_results_count}.
fire_results_as_kv The data that triggers an alert. Up to 100 rows of data are returned after set operations are performed. Format: [key1:value1,key2:value2]. [host:www.xhu.mock.com,pv:836,status:200][host:www.uua.mock.com,pv:780,status:200] The details of the data that triggers the alert is ${fire_results_as_kv}.

Data structure of the policy variable

Field Description Examples
alert_policy_id The ID of the alert policy. sls.test-alert
action_policy_id The ID of the action policy that is specified in the alert monitoring rule. This field is available only when you associate an alert policy with a dynamic action policy. sls.test-action
repeat_interval The interval between repeated alerts. This field is available only when you associate an alert policy with an action policy. 4h

Data structure of the results variable

The following table describes the fields in the results variable.

Field Description Examples
role_arn The Alibaba Cloud Resource Name (ARN). acs:ram::1234567890:role/aliyunslsalertmonitorrole
store_type The storage type.
  • log: logs
  • metric: time series data
  • meta: resource data
log
region The region where the destination Logstore or Metricstore resides. If the value of the store_type field is meta, the value of this field is left empty. cn-hangzhou
project The project to which the destination Logstore or Metricstore belongs. If the value of the store_type field is meta, this field is empty. sls-test-alert
store The name of the destination Logstore or Metricstore. test-logstore
query The query statement. error | select count(1) as cnt
start_time The beginning of the time range for a query. If the value of the store_type field is meta, this field is empty. 2006-01-02 15:04:05
start_time_ts The beginning of the time range for a query. The value is a UNIX timestamp. If the value of the store_type field is meta, this field is empty. 1616741485
end_time The end of the time range for a query. If the value of the store_type field is meta, this field is empty. 2006-01-02 15:04:05
end_time_ts The end of the time range for a query. The value is a UNIX timestamp. If the value of the store_type field is meta, this field is empty. 1616745085
dashboard_id The ID of the dashboard that is associated with the query. mydashboard
raw_results The query result. The field is of the array type. Up to 100 rows of data are returned. [{"host":"www.zc.mock.com","slbid":"slb-02","status":"200"},{"host":"www.evi.mock.com","slbid":"slb-01","status":"200"},{"host":"www.fo.mock.com","slbid":"slb-02","status":"306"},{"host":"www.gnp.mock.com","slbid":"slb-02","status":"200"},{"host":"www.tha.mock.com","slbid":"slb-01","status":"200"},{"host":"www.aoi.mock.com","slbid":"slb-02","status":"200"}]
fire_result The first row of the data that triggers the alert. A query result can contain multiple rows of data. This field shows the first row of the data. {"host":"www.zc.mock.com","slbid":"slb-02","status":"200"}