Event Alert Templates¶

When specifying event content, template syntax is supported. Users can render dynamic texts using template variables.

Template Variables¶

The syntax used for rendering variables is {{ Field Name }} and available event fields for text rendering are shown below:

Real User Metrics Monitoring (RUM)¶

In the Real User Metrics Monitoring (RUM), there are more available template variables as following:

Template Variables Example¶

Suppose there is a monitor with by option configured with region and host, and the template is shown blow:

Event name:

Monitor {{ df_monitor_checker_name }} found a fault with {{ df_dimension_tags }}

Event content:

- Region: {{ region }}
- Host: {{ host }}
- Status: {{ df_status }}
- Result: {{ Result }}
- Monitor: {{ df_monitor_checker_name }} (Alarm policy: {{ df_monitor_name }})

Then, once an error event is occured, the rendered output is shown blow:

Output event name:

Monitor monitor001 found a fault with {"region":"hangzhou",`host`:"web-001"}

Output event content:

- Region: hangzhou
- Host: web-001
- Status: error
- Result: 90.12345
- Monitor: monitor001 (Alarm policy: Team001)

Fields Containing Special Characters¶

In some cases, the deimension tag key may contains special characters such as -, @, etc., e.g., host-name, @level.

According to the template syntax, such field names can't be used as normal variable names, resulting in rendering failure.

In this case, {{ df_event['host-name'] }}, {{ df_event['@level'] }} can be used instead of {{ host-name }}, {{ @level }}.

Template Functions¶

In addition to displaying the variables in template directly, you can also use template functions to process the variables and beautify the output.

The basic syntax is the following:

{{ <template variable> | <template function> }}

Example is shown below:

Event time: {{ date | to_datetime }}

If the template function needs to pass parameters, then the syntax is shown below:

Event time: {{ date | to_datetime('America/Chicago') }}

CPU Percent: {{ (Result * 100) | to_round(2) }}

Available template functions are shown blow:

Template Function Example¶

Suppose there is a monitor with by option configured with region and host, and the template is shown blow:

Event name:

Monitor {{ df_monitor_checker_name }} found a fault with {{ df_dimension_tags | to_pretty_tags }}

Event content:

- Object: {{ df_dimension_tags | to_pretty_tags }}
- Time: {{ date | to_datetime }}
- Status: {{ df_status | to_status_human }}
- Result: {{ (Result * 100) | to_round(2) }}

Then, once an error event is occured, the rendered output is shown blow:

Output event name:

Monitor monitor001 found a fault with region:hangzhou, host:web-001

Output event content:

- Object: region:hangzhou, host:web-001
- Time: 2022-01-01 01:23:45
- Status: Error
- Result: 9012.35

Template Branch¶

The template also supports the use of branching syntax to render different content according to conditions.

Template Branch Sample¶

Branching can be implemented using the following syntax:

{% if df_status == 'critical' %}
Urgent problems, please deal with them immediately!
{% elif df_status == 'error' %}
Important problems, please deal with them
{% elif df_status == 'warning' %}
May be a problem, deal with it when free
{% elif df_status == 'nodata' %}
Data interrupted, please deal with it immediately!
{% else %}
No problem!
{% endif %}

A more typical example is shown below:

{% if  df_status != 'ok' %}
> Status: {{ df_status }}
> Host: {{ host }}
> Content: Elasticsearch JVM heap memory usage is {{ Result }}%
> Suggestion: The current JVM garbage collection can't keep up with the JVM garbage generation. Please check the business situation in time

{% else %}
> Status: {{df_status}}
> Host: {{host}}
> Content: Elasticsearch JVM heap memory alarm recovered

{% endif %}

Embedded DQL Query Function¶

In some cases, just using template variables will not satisfy the rendering requirements. In this case, additional data queries can be implemented using the embedded DQL query function.

The embedded DQL query function can perform any DQL statement in current workspace. Usually, the first element of data obtained from the query can be used as a template variable in the template as follows:

{% set dql_data = DQL("DQL statements to be performed") %}

some field: {{ dql_data.some_field }}

Embedded DQL Query Example¶

The following embedded DQL statement queries for data with a host field equal to "my_server" and assigns the first item of data to the dql_data variable:

{% set dql_data = DQL("O::HOST:(host, host_ip, os, datakit_ver) { host = 'my_server' }") %}

Host OS：{{ dql_data.os }}

And then {{ dql_data.os }} can be used in the template to output it's os field value.

Passing Parameters to Embedded DQL¶

Sometimes the DQL statement to be performed needs passing parameters.

Suppose there is a monitor with by option configured with region and host, and the template is shown blow:

{% set dql_data = DQL("O::HOST:(host_ip, os) { region = ?, host = ? }", region, host) %}

Host information:
IP：{{ dql_data.host_ip }}
OS: {{ dql_data.os }}

Since the event only contains region and host template variables for identifying different data, it does not contain more information such as IP address, OS, etc.

Therefore, using embedded DQL, you can use region and host as DQL query parameters to get the related data, and use {{ dql_data.host_ip }} etc. to output the related information.

Embedded DQL Query Function Details¶

The embedded DQL query function calling form is shown below:

DQL(dql, param_1, param_2, ...)

• The first parameter is a DQL statement and can contain the parameter placeholder ?
• Following parameters are the parameter values or variables of the DQL statement

The parameter placeholder ? are automatically escaped when replaced with a particular value.

Suppose, the variable host has the value "my_server", then the embedded DQL function and the actual DQL statement executed are shown below:

{% set dql_data = DQL("O::HOST:(host, host_ip, os, datakit_ver) { host = ? }",  host) %}

O::HOST:(host, host_ip, os, datakit_ver) { host = 'my_server' }

More about DQL¶