This topic describes the variables that are available for use in the new alert templates of Log Service. This topic also describes the methods that you can use to reference the variables.

Reference methods

Important You must reference variables by using the full names of the variables. If a referenced variable cannot be found or is invalid, Log Service replaces the variable with an empty string. If the value of a referenced variable is of the object type, the value is converted to a JSON string.

When you configure an action policy, you must select an alert template. The alert template specifies the content and subject of alert notifications. When you configure the Content and Subject parameters, you can use the {{ alert.xxx }} syntax to reference variables in the alert template. Before Log Service sends an alert notification, Log Service replaces the variables that are referenced in the Content and Subject parameters with the actual values of the variables. For example, Log Service replaces {{ alert.project }} with the name of the project to which the configured alert monitoring rule belongs.

You can also use control flows and built-in functions to manipulate and process variables. For more information about the syntax and built-in functions that are supported by the new alert templates, see Syntax for new alert templates and Built-in functions in alert templates.

Alert attributes

Variable Description Type Value example Reference example
aliuid The ID of the Alibaba Cloud account to which the project belongs. string 117918634953**** The project in which the alert is triggered belongs to the Alibaba Cloud account {{ alert.aliuid }}.
alert_instance_id The ID of the alert instance based on which the alert is triggered. string ee16a8f435485f3f-5be6b81edc520-3d6**** The ID of the alert instance based on which the alert is triggered is {{ alert.alert_instance_id }}.
alert_id The ID of the alert monitoring rule. Each alert monitoring rule must have a unique ID in the project to which the alert monitoring rule belongs. string alert-12345 The ID of the alert monitoring rule is {{ alert.alert_id }}.
alert_name The name of the alert monitoring rule. string Test rule The name of the alert monitoring rule based on which the alert is triggered is {{ alert.alert_name }}.
alert_type The type of the alert.
  • sls_alert: The alert is triggered based on an alert monitoring rule in Log Service.
  • sls_pub: The alert is ingested from an alerting system rather than Log Service.
  • sls_ml: The alert is triggered by intelligent inspection in Log Service.
string sls_alert The type of the alert is {{ alert.alert_type }}, which is converted to {{ alert.alert_type | format_type }}.
region The region. string cn-hangzhou The alert is triggered in the {{ alert.region }} region.
project The project to which the alert monitoring rule belongs. string my-project The alert monitoring rule based on which the alert is triggered belongs to the {{ alert.project }} project.
next_eval_interval The length of time before the next evaluation activity starts. Unit: seconds. int 300 The next evaluation activity starts after {{ alert.next_eval_interval }} seconds.
alert_time The time at which the current evaluation activity starts. int 1616744734 The current evaluation activity starts at {{ alert.alert_time }}, which is converted to {{ alert.alert_time | format_date }}.
fire_time The time at which the alert is triggered for the first time. int 1616059834 The alert is triggered at {{ alert.fire_time }} for the first time, which is converted to {{ alert.fire_time | format_date }}.
status The status of the alert.
  • firing: The alert is triggered.
  • resolved: The alert is cleared.
string firing The status of the alert is {{ alert.status }}, which is converted to {{ alert.status | format_status }}.
resolve_time The time at which the alert is cleared.
  • If the alert is in the firing state, the value is 0.
  • If the alert is in the resolved state, the value is the point in time at which the alert is cleared.
int 0 The alert is cleared at {{ alert.resolve_time }}, which is converted to {{ alert.resolve_time | format_date }}.
severity The severity level of the alert.
  • 10: Critical
  • 8: High
  • 6: Medium
  • 4: Low
  • 2: Report
 int 10 The severity level of the alert is {{ alert.severity }}, which is converted to {{ alert.severity | format_severity }}.
labels The labels of the alert. map {"env":"test"} The labels of the alert are {{ alert.labels | to_list }}.
annotations The annotations of the alert. map { "title": "Alert title","desc": "Alert description" } The annotations of the alert are {{ alert.annotations | to_list }}.
results The parameters and intermediate results that are returned. The value of this variable is an array. For more information about the value of this variable, see the "Description of the results variable" section of this topic. array 
[{
    "store_type": "log",
    "region": "cn-hangzhou",
    "project": "sls-alert-test",
    "store": "test",
    "query": "* | select count(1) as cnt",
    "start_time": 1616741485,
    "end_time": 1616745085,
    "dashboard_id": "mydashboard",
    "raw_results": [{
        "cnt": "4"
    }],
    "raw_result_count": 1,
    "fire_result": {
        "cnt": "4"
    },
    "truncated": false,
    "role_arn": ""
}]
 The first query starts at {{ alert.results[0].start_time }} and ends at {{ alert.results[0].end_time }}. The value of the count variable is {{ alert.results[0].fire_result.cnt }}. The query statement is {{ alert.results[0].query }}.
fire_results The data records for which the alert is triggered. Up to 100 data records can be returned in response to a set operation on data.

If the value of fire_results exceeds 2 KB in size, the value is truncated, and the excess part is discarded.

array 
[{
    "host": "example.com",
    "host__1": "example.com",
    "pv": "836",
    "slbid": "slb-02",
    "status": "200"
}, {
    "host": "example.com",
    "host__1": "example.com",
    "pv": "836",
    "slbid": "slb-02",
    "status": "200"
}]
 The alert is triggered for the following data records: {{ alert.fire_results | to_json }}.
fire_results_count The total number of data records for which the alert is triggered. The value of this variable may be greater than 100. For example, if you perform a CROSS JOIN operation on data, Log Service may trigger an alert for more than 100 data records. int 3 The alert is triggered for a total of {{ alert.fire_results_count }} data records.
condition The trigger condition based on which the alert is triggered. The condition is an expression. Log Service replaces the variables in the trigger condition with the values that trigger the alert. Each value is enclosed in a pair of brackets []. The value of this variable is in the Count:Quantity expression;Condition:Matching expression format. string Count:[5] > 3;Condition:[example.com]=='example.com' The trigger condition based on which the alert is triggered is {{ alert.condition }}.
raw_condition The original trigger condition. The variables in the trigger condition are not replaced. The value of this variable is in the Count:Quantity expression;Condition:Matching expression format. string Count:__count__ > 3;Condition:host=='example.com' The original trigger condition is {{ alert.raw_condition }}.
policy The ID of the alert policy or action policy. For more information about the value of this variable, see the "Description of the policy variable" section of this topic. map 
{
    "alert_policy_id": "sls.test-alert",
    "action_policy_id": "sls.test-action",
    "repeat_interval": "5m0s"
}
 The ID of the alert policy is {{ alert.policy.alert_policy_id }}.
dashboard The name of the dashboard that is associated with the alert. string mydashboard The name of the dashboard that is associated with the alert is {{ alert.dashboard }}.
alert_url The URL of the details page of the alert. string https://sls.console.aliyun.com/lognext/project/test-xxxx/alert/alert-1617164106-940166 The URL of the details page of the alert is {{ alert.alert_url }}.
query_url The URL of the source web page that is accessed for the first query. string https://sls.console.aliyun.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcyBjbnQ%3D&queryTimeType=99&startTime=1617175089 The URL of the source web page that is accessed for the first query is {{ alert.query_url }}.
alert_history_dashboard_url The URL of the Alert History Statistics dashboard. string https://sls.console.aliyun.com/lognext/project/test-xx/dashboard/internal-alert-analysis The URL of the Alert History Statistics dashboard is {{ alert.alert_history_dashboard_url }}.
dashboard_url The URL of the dashboard that is associated with the alert. string https://sls.console.aliyun.com/next/project/myproject/dashboard/mydashboard The URL of the dashboard that is associated with the alert is {{ alert.dashboard_url }}.
fingerprint The fingerprint of the alert. For more information, see Deduplicate alerts based on fingerprints: string 478325709134bc5c The fingerprint of the alert is {{ alert.fingerprint }}.
signin_url The URL of the page on which you can view the details of the alert without the need to log on to the Log Service console. For more information, see View alert details in logon-free mode: string https://sls.console.aliyun.com/console/AlertAjax/slsSignIn.json?token=xxxx [View Details]({{ alert.signin_url }})

Description of the policy variable

The following table describes the variables that can be referenced in the policy variable.

Variable Description Type Value example
alert_policy_id The ID of the alert policy string sls.test-alert
action_policy_id The ID of the action policy that you configure in the alert monitoring rule. This variable is available only when you select Dynamic Action Policy for the alert policy. string sls.test-action
repeat_interval The period during which the action policy is executed only once and Log Service sends only one alert notification if duplicate alerts are triggered. This variable is available only when you select Dynamic Action Policy for the alert policy. string 4h

Description of the results variable

The following table describes the variables that can be referenced in the results variable.

Variable Description Type Value example
store_type The storage type.
  • log: log data
  • metric: metric data
  • meta: resource data
string log
region The region where the destination Logstore or Metricstore resides.

If the value of the store_type variable is meta, this variable is empty.

string cn-hangzhou
project The project to which the destination Logstore or Metricstore belongs.

If the value of the store_type variable is meta, this variable is empty.

string sls-test-alert
store The name of the destination Logstore or Metricstore. string test-logstore
query The query statement. string error | select count(1) as cnt
start_time The beginning of the time range to query.

If the value of the store_type variable is meta, this variable is empty.

int 1616741485
end_time The end of the time range to query.

If the value of the store_type variable is meta, this variable is empty.

int 1616745085
raw_results The data records that are queried. The value of this variable is an array. Up to 100 data records can be returned.

If the value of fire_results exceeds 2 KB, the value is truncated, and the excess part is discarded.

array 
[{
    "host": "example.com",
    "slbid": "slb-02",
    "status": "200"
}, {
    "host": "example.com",
    "slbid": "slb-01",
    "status": "200"
}]
raw_results_count The number of data records that are queried. The number may be greater than 100. int 20
fire_result The first data record among the data records for which the alert is triggered. The result set for which the alert is triggered may contain multiple data records. Log Service returns only the first data record of the result set for this variable. map 
{
    "host": "example.com",
    "slbid": "slb-02",
    "status": "200"
}
query_url The URL of the data records that are queried.

If the value of the store_type variable is meta, this variable is empty.

string https://sls.console.aliyun.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcyBjbnQ%3D&queryTimeType=99&startTime=1617175089
dashboard_url The URL of the dashboard that is associated with the query. string https://sls.console.aliyun.com/next/project/myproject/dashboard/mydashboard
role_arn The Alibaba Cloud Resource Name (ARN) of the service role that is used. string acs:ram::117918634953****:role/aliyunslsalertmonitorrole