Reference Variables

Customize incident severity, title, and other information by referencing alert labels and attributes

Overview

By referencing variables from alert labels and attributes, you can modify and customize incident severity, title, description, and other information. This is primarily used in two scenarios:

Event API Reporting

When reporting custom alert events via the alert Event API, you can use the title_rule field to customize the alert title.

Alert Pipeline

Reference variables in alert pipelines to modify alert severity, title, description, and other information.

Event API Example

title_rule

{
  "title_rule": "[TPL]${resource} / ${check}"
}

Specifies resource and check labels as the alert title.

Alert Pipeline Example

Variable Reference Methods

Reference Labels via ${var}

Use [TPL] as prefix and ${} to reference variables. Variable content is extracted from labels; if extraction fails, <no value> is used as a placeholder.

Rule	Label Values	Generated Content
[TPL]${resource} / ${check}	{"resource": "127.0.0.1", "check": "cpu idle low"}	127.0.0.1 / cpu idle low
[TPL]${resource} / ${check}	{"resource": "127.0.0.1"}	127.0.0.1 / <no value>
[TPL]${resource} / Host Down	{"resource": "127.0.0.1"}	127.0.0.1 / Host Down

Reference via Golang Template Syntax

Use [TPL] as prefix and {{}} to reference variables (can reference both labels and attributes); if extraction fails, returns an empty string for missing labels.

Rule	Variable Values	Generated Content
[TPL]{{.Labels.resource}} / {{.Labels.check}}	{"resource": "127.0.0.1", "check": "cpu idle low"}	127.0.0.1 / cpu idle low
[TPL]{{.Labels.resource}} / {{.Labels.check}}	{"resource": "127.0.0.1"}	127.0.0.1 /
[TPL]{{.EventSeverity}} / Host Down	{"EventSeverity": "Warning"}	Warning / Host Down

${} syntax and {{}} syntax have two key differences:

• Data scope: ${name} reads only from Labels and cannot reference attribute fields; {{}} uses the whole *AlertEvent as the data source, so you can access every exported attribute as well as Labels.
• Missing-value behavior: when a label is missing, ${} returns <no value> while {{}} returns an empty string.

Supported Attributes

When you use {{}} syntax, the template data object is the alert event (AlertEvent) itself. The main fields you can reference are listed below:

Field	Type	Description
Title	string	Alert title
Description	string	Alert description
EventSeverity	string	Severity (Critical / Warning / Info)
EventStatus	string	Event status (Critical / Warning / Info / Ok, where Ok indicates recovery)
AlertKey	string	The alert’s unique key, used to merge events from the same series into a single alert
TitleRule	string	The title-generation rule supplied at report time
IntegrationType	string	Integration type (such as prometheus or zabbix.v5)
IntegrationName	string	Integration name
Labels	map	Label key-value set; access a specific label with {{.Labels.xxx}}

Besides the title, the alert description and any label value also support reference variables: in an alert pipeline, when you use the Reset Description (resetDescription) or Reset Labels (resetLabels) action, any content prefixed with [TPL] goes through the same variable substitution.

FAQ

What happens if a label doesn't exist when using labels to dynamically generate titles?

Depending on which variable retrieval method you use, the title may retain the original variable information or use <no value> as a placeholder.

Even if a variable cannot be retrieved, it won’t affect alert generation. You can debug with confidence.