Alerting rules can use the Mustache template syntax ({{variable name}}) to pass values when its actions run.

The available variables differ by rule type, however there are some common variables:

Some cases exist where the variable values will be "escaped" when used in a context where escaping is needed. For example:

Mustache also supports "triple braces" of the form {{{variable name}}}, which indicates no escaping should be done at all. Use this form with caution, since it could end up rendering the variable content such that the resulting parameter is invalid or formatted incorrectly.

Generaledit

All rule types pass the following variables:

Action frequency: Summary of alertsedit

If the rule’s action frequency is a summary of alerts, it passes the following variables:

Action frequency: For each alertedit

If the rule’s action frequency is not a summary of alerts, it passes the following variables:

Contextedit

If the rule’s action frequency is not a summary of alerts, the rule defines additional variables as properties of the variable context. For example, if a rule type defines a variable value, it can be used in an action parameter as {{context.value}}.

For diagnostic or exploratory purposes, action variables whose values are objects, such as context, can be referenced directly as variables. The resulting value will be a JSON representation of the object. For example, if an action parameter includes {{context}}, it will expand to the JSON representation of all the variables and values provided by the rule type. To see alert-specific variables, use {{.}}.

For situations where your rule response returns arrays of data, you can loop through the context:

{{#context}}{{.}}{{/context}}

For example, looping through search result hits:

triggering data was:
{{#context.hits}} - {{_source.message}}
{{/context.hits}}