Docs

Torch Log Service

Alarm notification content template

Notification content overview

When configuring an alarm policy in TLS, notification content can be set as regular strings or customized content using content syntax, functions, and variables to provide more detailed and clear alarm information in the notification.

Features overview

Notification content in TLS alarm notifications supports the following syntax features:

Content variable: When configuring alarm notification content, you can add variables in addition to fixed text strings. When TLS sends an alarm notification according to the alarm policy, it automatically replaces the variables in the notification content with the corresponding actual values. For example, for the content variable {{ AccountID }}, TLS will replace it with the current Volcanoengine Account ID.

Content syntax: TLS provides built-in content syntax for alarm features, supporting custom design and formatting of notification content and style to meet the requirements for notification customization in various scenarios.

Content functions: Variable functions provide processing for content variables, such as escaping special characters and extracting substrings, and can also filter specific content using filters.

Notice

TLS alarm notification content also supports custom processing through advanced functions and filters. If you have specific business scenarios, you can contact technical support through the ticketing system for more information.

Notification content example

Example scenario: Set an alarm policy for access logs on a website to monitor events where a client makes more than 1,000 requests within 1 second. If this event occurs 3 times or more within 5 minutes, an alert is triggered. The alarm notification displays basic information about the alarm policy and the log that triggered the alert.

Notice

This alarm notification format uses Larkchannel as an example. Other channels may not support content styles such as . Please refer to the official documentation of your application when composing alarm notifications.

Raw log sample:

[
{
"Status":200,
"ReqTime":10,
"ReqSize":123,
"RemoteAddr":"10.1.1.*",
"ClientInfo":{
"User_Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
"Region":"cn-beijing"
},
"Method":"POST",
"URL":"/xxxxxx",
"Action":"Action1",
},
{
"Status":200,
"ReqTime":8,
"ReqSize":123,
"RemoteAddr":"10.1.1.*",
"ClientInfo":{
"User_Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
"Region":"cn-beijing"
},
"Method":"POST",
"URL":"/xxxxxx",
"Action":"Action1",
}
]

Notification content configuration:

User{{UserName}} region {{Region}} log topic {{Topics|join:","}}triggers an alarm.
Alarm basic inormation is as follows:：
- Triggering policy name：{{Alarm}}
- Alarm time：{{NotifyTime}}
- Execution statement:
{%-for query in ExecuteQuery%}
{{-replace("*","\\*",query)}}
{%endfor-%}
- Triggering condition:
{%-for param in TriggerParams%}
{{-param}}
{%endfor-%}
{% if QueryUrl -%}
Detailed alarm information is as follows:
- Log query details({{ QueryUrl }})
{% endif -%}
{% if DetailUrl -%}
- Alarm execution history({{ DetailUrl }})
{% endif -%}

Actual notification content:

User volcengine region cn-beijing log topic accesslog triggers an alarm.
Basic alarm information is as follows:
- Alarm policy name：frequency-control
- Alarm time：2022-12-09 17:11:17
- Execution statement:* | select RemoteAddr, pv from (select RemoteAddr, sum(case when ReqTime > 1000 then 1 else 0 end) as pv group by RemoteAddr) order by pv desc
- Triggering condition: $1.pv >= 3
- Detailed alarm information is as follows:
- [Log query details](https://www.volcengine.com)
- [Alarm execution history](https://www.volcengine.com)

Last updated: 2026.04.13 18:20:13