All Products
Search

This Product

    Simple Log Service:Variables in alert templates

    Document Center

    Simple Log Service:Variables in alert templates

    Last Updated:Jul 10, 2026

    Use variables in alert templates to dynamically populate notification content and subjects.

    Variable reference

    Important

    • Variable names must be an exact match.

      • If a variable does not exist or a reference is invalid, it defaults to an empty string.

      • Referenced objects are converted to JSON strings.

    • Variable names can contain letters, digits, and underscores (_) but must not start with a digit.

      • If a variable name follows these rules, you can retrieve its value by using dot notation, for example, {{alert.xxx}}.

      • If a variable name contains special characters, such as __tag__:__namespace__, you must use bracket notation to retrieve its value, such as {{alert.annotations["__tag__:__namespace__"] }}.

    When you configure an action policy, select an alert template that defines the notification content and subject. In the Send Content and Subject/Title fields, reference template variables by using the {{ alert.xxx }} syntax. Simple Log Service (SLS) replaces each variable with its actual value when sending notifications. For example, {{ alert.project }} is replaced with the project name of the alert rule.

    For example, in a DingTalk channel template, set the Subject to SLS Alert and use variables like {{ alert.aliuid }}, {{ alert.project }}, {{ alert.alert_name }}, and {{ alert.severity }} in the Content to include the account ID, project name, alert rule name, and severity.

    You can also use control flow and built-in functions to process variable data. For more information, see Alert Template Syntax (New) and Built-in Template Functions.

    Alert attributes

    Parameter

    Description

    Type

    Value

    Reference example

    aliuid

    The Alibaba Cloud account ID of the Project.

    string

    117918634953****

    The alert rule for user {{ alert.aliuid }} has been triggered.

    alert_instance_id

    The ID of the instance that triggered the alert.

    string

    ee16a8f435485f3f-5be6b81edc520-3d6****

    The instance ID is {{ alert.alert_instance_id }}.

    alert_id

    The unique ID of the alert rule within the Project.

    string

    alert-12345

    The alert rule ID is {{ alert.alert_id }}.

    alert_name

    The name of the alert rule.

    string

    Test alert rule

    Alert rule {{ alert.alert_name }} has been triggered.

    alert_type

    The alert type.

    • sls_alert: The alert is triggered by an alert monitoring rule.

    • sls_pub: The alert is an open alert from an external system.

    • sls_ml: The alert is triggered by intelligent inspection.

    string

    sls_alert

    The alert type is {{ alert.alert_type }}, which is formatted as {{ alert.alert_type | format_type }}.

    region

    The region where the alert was triggered.

    string

    cn-hangzhou

    The alert was triggered in region {{ alert.region }}.

    project

    The Project to which the alert rule belongs.

    string

    my-project

    An alert rule was triggered in Project {{ alert.project }}.

    next_eval_interval

    The next evaluation interval, in seconds.

    int

    300

    Next evaluation in {{ alert.next_eval_interval }} seconds.

    alert_time

    The UTC timestamp of the current evaluation.

    int

    1616744734

    The current evaluation time is {{ alert.alert_time }}, which is formatted as {{ alert.alert_time | format_date }}.

    fire_time

    The UTC timestamp when the alert first fired.

    int

    1616059834

    The alert first fired at {{ alert.fire_time }}, which is formatted as {{ alert.fire_time | format_date }}.

    status

    The current status of the alert.

    • firing: The alert is active.

    • resolved: The alert is resolved.

    string

    firing

    The alert status is {{ alert.status }}, formatted as {{ alert.status | format_status }}.

    resolve_time

    The UTC timestamp when the alert was resolved.

    • If the alert status is firing, the value is 0.

    • If the alert status is resolved, the value is the resolution time.

    int

    0

    The alert was resolved at {{ alert.resolve_time }}, which is formatted as {{ alert.resolve_time | format_date }}.

    severity

    The severity of the alert.

    • 10: Critical

    • 8: High

    • 6: Medium

    • 4: Low

    • 2: Report

    int

    10

    The alert severity is {{ alert.severity }}, formatted as {{ alert.severity | format_severity }}.

    labels

    A set of user-defined key-value labels.

    map

    {"env":"test"}

    The alert labels are {{ alert.labels | to_list }}.

    annotations

    A set of user-defined key-value annotations.

    map

    { "title": "Alert title","desc": "Alert description" }

    The alert annotations are {{ alert.annotations | to_list }}.

    results

    An array of query parameters and intermediate results. For more information about the values of this variable, see QueryData structure.

    array

    See the appendix at the end of this topic.

    The start time of the first query is {{ alert.results[0].start_time }}, the end time is {{ alert.results[0].end_time }}, the count is {{ alert.results[0].fire_result.cnt }}, and the query is {{ alert.results[0].query }}.

    fire_results

    The data that triggered the alert, which is the result of the set operation. A maximum of 100 rows are returned.

    If the size of the fire_results variable exceeds 2 KB, or if the content of a single field exceeds 1 KB, the data is truncated. For information about how to handle truncated data, see What do I do if an alert is triggered for too many logs and the notification displays incomplete information?

    array

    See the appendix at the end of this topic.

    The data that triggered the alert is {{ alert.fire_results | to_json }}.

    fire_results_count

    The total number of data rows that triggered the alert. This value can be greater than 100, for example, after a Cartesian product operation.

    int

    3

    The alert was triggered by {{ alert.fire_results_count }} data rows.

    condition

    The evaluation expression that triggered the alert, with variables replaced by their actual trigger values enclosed in square brackets []. The format is Count:Expression;Condition:Expression.

    string

    Count:[5] > 3;Condition:[example.com]=='example.com'

    The alert evaluation expression is {{ alert.condition }}.

    raw_condition

    The original evaluation expression with variables not replaced by their actual values. The format is Count:Expression;Condition:Expression.

    string

    Count:__count__ > 3;Condition:host=='example.com'

    The original evaluation expression is {{ alert.raw_condition }}.

    policy

    The alert policy or action policy. For more information about the values of this variable, see Policy structure.

    map

    See the appendix at the end of this topic.

    The alert policy ID is {{ alert.policy.alert_policy_id }}.

    dashboard

    The name of the dashboard associated with the alert.

    string

    mydashboard

    The associated dashboard is {{ alert.dashboard }}.

    alert_url

    The URL to the alert details page.

    string

    https://sls.console.alibabacloud.com/lognext/project/test-xxxx/alert/alert-1617164106-940166

    The alert URL is {{ alert.alert_url }}.

    query_url

    The URL for the search page of the first query.

    string

    https://sls.console.alibabacloud.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcyBjbn****&queryTimeType=99&startTime=1617175089

    The URL for the first query page is {{ alert.query_url }}.

    alert_history_dashboard_url

    The URL of the Alert History Statistics dashboard.

    string

    https://sls.console.alibabacloud.com/lognext/project/test-xx/dashboard/internal-alert-analysis

    The URL of the Alert History Statistics dashboard is {{ alert.alert_history_dashboard_url }}.

    dashboard_url

    The URL of the dashboard associated with the alert.

    string

    https://sls.console.alibabacloud.com/next/project/myproject/dashboard/mydashboard

    The URL of the associated dashboard is {{ alert.dashboard_url }}.

    fingerprint

    The alert fingerprint. For more information, see Deduplicate alerts based on alert fingerprints.

    string

    478325709134bc5c

    The alert fingerprint is {{ alert.fingerprint }}.

    signin_url

    A URL for viewing alert details without logging in to the console. For more information, see View alert details without logging in.

    string

    https://sls.console.alibabacloud.com/console/AlertAjax/slsSignIn.json?token=xxxx

    [View Details]({{ alert.signin_url }})

    Policy structure

    The policy variable contains the following fields.

    Parameter

    Description

    Type

    Value example

    alert_policy_id

    The ID of the alert policy.

    string

    sls.test-alert

    action_policy_id

    The ID of the action policy configured for the alert rule. Available only when the alert rule uses a Dynamic Action Policy.

    string

    sls.test-action

    repeat_interval

    The notification resend interval for an active alert. Available only when the alert rule uses a Dynamic Action Policy.

    string

    4h

    Query data structure

    The results variable contains the following fields.

    Parameter

    Description

    Type

    Value

    store_type

    The storage type. Valid values are:

    • log: Log data.

    • metric: Metric data.

    • meta: Resource data.

    string

    log

    region

    The region where the destination store is located.

    This variable is empty if the value of store_type is meta.

    string

    cn-hangzhou

    project

    The project where the destination store is located.

    This variable is empty if the value of store_type is meta.

    string

    sls-test-alert

    store

    The name of the destination store.

    string

    test-LogStore

    query

    The query statement.

    string

    error | select count(1) as cnt

    start_time

    The query start time, specified as a UTC timestamp.

    This variable is empty if the value of store_type is meta.

    int

    1616741485

    end_time

    The query end time, specified as a UTC timestamp.

    This variable is empty if the value of store_type is meta.

    int

    1616745085

    raw_results

    An array of the query results, containing up to 100 rows.

    If the raw_results variable exceeds 2 KB, or if a field in the results exceeds 1 KB, the excess data is truncated.

    array

    		 
    [{
    "host": "example.com",
    "slbid": "slb-02",
    "status": "200"
}, {
    "host": "example.com",
    "slbid": "slb-01",
    "status": "200"
}]

    raw_results_count

    The total number of rows in the result set, which can be greater than 100.

    int

    20

    fire_result

    The first record of the alert trigger result, even if the result set contains multiple records.

    map

    		 
    {
    "host": "example.com",
    "slbid": "slb-02",
    "status": "200"
}

    query_url

    The URL of the query page in the console.

    This variable is empty if the value of store_type is meta.

    string

    https://sls.console.alibabacloud.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcy*******&queryTimeType=99&startTime=1617175089

    dashboard_url

    The URL of the dashboard associated with the query.

    string

    https://sls.console.alibabacloud.com/next/project/myproject/dashboard/mydashboard

    role_arn

    The Alibaba Cloud Resource Name (ARN) of the service role.

    string

    acs:ram::117918634953****:role/aliyunslsalertmonitorrole

    FAQ

    Appendix

    • results sample:

      [{
    "store_type": "log",
    "region": "cn-hangzhou",
    "project": "sls-alert-test",
    "store": "test",
    "query": "* | select count(1) as cnt",
    "start_time": 1616741485,
    "end_time": 1616745085,
    "dashboard_id": "mydashboard",
    "raw_results": [{
        "cnt": "4"
    }],
    "raw_result_count": 1,
    "fire_result": {
        "cnt": "4"
    },
    "truncated": false,
    "role_arn": ""
}]

    • fire_results sample:

      [{
    "host": "example.com",
    "host__1": "example.com",
    "pv": "836",
    "slbid": "slb-02",
    "status": "200"
}, {
    "host": "example.com",
    "host__1": "example.com",
    "pv": "836",
    "slbid": "slb-02",
    "status": "200"
}]

    • policy sample:

      {
    "alert_policy_id": "sls.test-alert",
    "action_policy_id": "sls.test-action",
    "repeat_interval": "5m0s"
}

    Example

    The following example defines notification content by using the new content template:

    • Alert content:

      {
    "alert_id": "test-alert",
    "alert_name": "PV/UV Alert",
    "project": "project-1",
    "status": "firing",
    "severity": 6,
    "labels": {
        "app": "nginx",
        "host": "host-1"
    },
    "results": [
        {
            "project": "project-1",
            "logstore": "logstore-1",
            "query": "* | select count(*) as pv"
        },
        {
            "project": "project-2",
            "logstore": "logstore-2",
            "query": "* | select count(distinct user_id) as uv"
        }
    ]
}

    • Alert template configuration:

      - Alert ID: {{ alert.alert_id }}
- Alert Name: {{ alert.alert_name }}
- Project: {{ alert.project }}
- Status: {% if alert.status == "firing" %}FIRING{% else %}RESOLVED{% endif %}
- Labels:
{%- for key, val in alert.labels.items() %}
    - {{ key }}: {{ val }}
{%- endfor %}
- Query: {{ alert.results[0].query }}

    • Output result:

      - Alert ID: test-alert
- Alert Name: PV/UV Alert
- Project: project-1
- Status: FIRING
- Labels:
    - app: nginx
    - host: host-1
- Query: * | select count(*) as pv