Docs

Torch Log Service

Alarm notification content template

Content variable

When configuring alarm notification content, you can add variables in addition to fixed text strings. This topic provides details on the variable format and lists all supported variables.

Variable format

You can directly reference content variables in alarm notification content. The variable format is {{variable name}}, and each variable must be enclosed with two braces{{ }}. When TLS sends an alarm notification, it automatically replaces the variables in the notification content with the corresponding actual values. For example, for the content variable {{AccountID}}, TLS will replace it with the current alarm policy's Volcanoengine Account ID.

Notice

Variable names are case-sensitive. When referencing variables in alarm notification content, the variable name must exactly match the Variable column in Variable list.

If the variable name or format is incorrect, TLS will replace it with an empty string.

If the referenced value is an object type, use the toJson or toString function to convert the format, or use a for loop to iterate through it. Otherwise, the returned content may not meet expectations.

If the referenced value is an array object, use the {{a[i][j].b}} format to obtain subfield values within the array object, such as {{QueryResult[0][0].count}}.

Content variable

Variable list

You can reference the following variables in TLS alarm notification content.

Variable	Type	Description	Example value
{{AccountID}}	String	The account ID associated with the alarm policy.	Configuration example: The alarm in {{AccoutID}} account has been triggered. Alarm notification example: The alarm in 20000****6account has been triggered.
{{UserName}}	String	The username of the account associated with the alarm policy. It is not recommended to use this variable in content templates for Lark, DingTalk, WeCom, and custom Webhook channels. If so, the value of this variable remains empty in these channels.	Configuration example: Alarm in {{UserName}} user has been triggered Alarm notification example: Alarm in xxxngine user has been triggered.
{{ProjectName}}	String	The project that triggered the alarm.	Configuration example: The project {{ProjectName}} triggered an alarm. Alarm notification example: The project http_module triggered an alarm.
{{AlarmTopicName}}	String	The log topic that triggered the alarm.	Configuration example: The log topic {{AlarmTopicName}} triggered an alarm. Alarm notification example: The log topic http_module triggered an alarm.
{{NotifyMsg}}	String	The original content in the additional notification content of the alarm policy is replaced with the rendered content. This variable is only supported in the content template. Using this variable in the additional notification content of the alarm policy is not recommended. This variable is not supported in recovery-type alarm notifications.	Configuration example: Alarm notification content: {{NotifyMsg}}. Example of additional notification content in an alarm policy: Under the {{AccoutID}} account, the log topic {{AlarmTopicName}} triggered an alarm. Alarm notification example: Alarm notification: A warning was triggered by the log topic http_module under the account 20000****6.
{{Message}}	String	Original content entered in the additional notification content field of the alarm policy. The entered alarm variables are not parsed; the original content is sent directly.	Configuration example: Original notification: {{Message}}. Example of additional notification content in an alarm policy: {{AccoutID}} account triggered a warning for {{AlarmTopicName}} alarm topic. Alarm notification example: Original notification: {{AlarmTopicName}}under {{AccoutID}} account triggered an alarm.
{{Region}}	String	The region where the project associated with the alarm policy is located.	Configuration example: {{Region}} region alarm policy {{Alarm}} has been triggered. Alarm notification example: cn-beijing region alarm policy threshold alarm has been triggered.
{{Alarm}}	String	Alarm policy name.	Configuration example: Alarm policy {{Alarm}} has been triggered. Alarm notification example: Alarm policy Over-limit Alarm has been triggered.
{{AlarmID}}	String	Alarm policy ID.	Configuration example: Alarm policy {{AlarmID}} has been triggered. Alarm notification example: The alarm policy 7070267f-30da-4861-8d0a-01f4bc6**** has been triggered.
{{ExecuteQuery}}	[]String	Query statements configured in the alarm policy.	Configuration example: The current alarm policy's query and analysis statement is {{toJson(ExecuteQuery)}}.query and analysis. Alarm notification example: The current alarm policy's query and analysis statement is ["* \| select RemoteAddr, pv from (select RemoteAddr, sum(case when ReqTime > 1000 then 1 else 0 end) as pv group by RemoteAddr) order by pv desc"].
{{Duration}}	String	Alarm duration. The unit is minutes.	Configuration example: The alarm lasts for {{Duration}} minutes. Alarm notification example: The alarm lasts for 3 minutes.
{{Condition}}	String	Trigger conditions configured in the alarm policy.	Configuration example: The trigger condition for the current alarm policy is {{Condition}}. Alarm notification example: The trigger condition for the current alarm policy is $1.pv >= 3.
{{HappenThreshold}}	Integer	The alarm cycle configured in the alarm policy for sending alarms.	Configuration example: This alarm policy sends an alarm if the trigger condition is met for {{HappenThreshold}} consecutive monitoring cycles. Alarm notification example: If this alarm policy meets the trigger conditions for 5 consecutive monitoring cycles, an alarm is sent.
{{Topics}}	[]String	The monitoring targets configured in the alarm policy refer to all log topics currently monitored by this alarm policy.	Configuration example: The monitored log topics include {{Topics\|join:','}}. Alarm notification example: The monitored log topics include ycyc, abab.
{{TopicIds}}	[]String	The IDs of all log topics monitored by the alarm policy.	Configuration example: The monitored log topics include {{TopicIds\|join:','}}. Alarm notification example: The monitored log topics include a573686e-d097-4227-9fa5-612d0ae2**, 4a7796bd-76a5-45ec-880b-680c45cb**.
{{StartTime}}	String	The time when the alarm is first triggered in a complete alarm event. A complete alarm event starts from alarm triggered and ends at alarm recovery. Alarm recovery marks the end of this alarm event.	Configuration example: The time when the alarm was first triggered is {{StartTime}}. Alarm notification example: The time when the alarm was first triggered is 2022-12-09 20:43:16.
{{StartTimeUnix}}	Integer	The timestamp of the first alarm trigger in the event. Format: second-level UNIX timestamp.	Configuration example: The timestamp for the first alarm trigger is {{StartTimeUnix}}. Alarm notification example: The timestamp for the first alarm trigger is 1670589796.
{{NotifyTime}}	String	The notification time for this alarm.	Configuration example: The alarm notification time is {{NotifyTime}}. Alarm notification example: The alarm notification time is 2022-12-09 20:43:16.
{{NotifyTimeUnix}}	Integer	The timestamp for this alarm notification. Format: second-level UNIX timestamp.	Configuration example: The alarm notification timestamp is {{NotifyTimeUnix}}. Alarm notification example: The alarm notification timestamp is 1670589796.
{{NotifyType}}	Integer	Alarm notification types. 1: Trigger 2: Recovery	Configuration example: The alarm notification type is {{NotifyType}}. Alarm notification example: The alarm notification type is 1.
{{Severity}}	String	The alarm level configured in the alarm policy represents the severity of the alarm. Notification: notification. Warning: warning. Serious: severe.	Configuration example: The alarm level is {{Severity}}. Alarm notification example: The alarm level is notice.
{{ConsecutiveAlertNums}}	Integer	Number of consecutive alarms.	Configuration example: The number of consecutive alarms is {{ConsecutiveAlertNums}}. Alarm notification example: The number of consecutive alarms is 3.
{{TriggerParams}}	[]String	The actual values of the fields in the trigger conditions when the alarm is triggered.	Configuration example: The actual value of the field in the trigger condition is {{toJson(TriggerParams)}}. Alarm notification example: The actual value of the field in the trigger condition is ["$1.count=100"].
{{DetailUrl}}	String	Link to the alarm policy execution information page. For more details, see View alarm execution results.	Configuration example: Click the link {{DetailUrl}} to view execution history. Alarm notification example: Click the link https://console.volcengine.com/tls/region:tls+cn-beijing/project/a573686e-d097-4227-9fa5-612d0ae2**/alarms/7070267f-30da-4861-8d0a-01f4bc6d5**detail to view execution history.
{{QueryUrl}}	String	Link to the query and analysis page for the first execution statement in the alarm policy.	Configuration example: Query details: {{QueryUrl}} Alarm notification example: Query details: https://console.volcengine.com/tls/region:tls+cn-beijing/project/0abbb4ff-9eba-4079-af37-eec515e0****/search?topicId=&time=now-5m,now&codebase64=&hideTitle=false&hideTopic=false&hideIndexBtn=false&hideShareBtn=false
{{QueryResult}}	[][]Object	Execution results of the query and analysis statement triggered by an alarm. Object type. It is recommended to convert formats using toJson or toString. Each execution statement returns up to 10 rows, with a maximum total length of 10 KB. You can add up to three execution statements, with a maximum total length of 30 KB.	If you need examples, see QueryResult variable.
{{QueryResultStr}}	[]String	Returns QueryResult results as a string array. Index access for {{QueryLogStr[0]}} is not supported currently.	If you need examples, see QueryResult variable.
{{QueryLog}}	[][]Object	Original log information matched by query conditions in the execution statement. Filtering conditions from analysis statements are not included. Object type. It is recommended to convert formats using toJson or toString. Each execution statement returns up to 1,000 raw logs, with a maximum total length of 10 KB. You can add up to three execution statements, with a maximum total length of 30 KB.	If you need examples, see QueryLog variable.
{{QueryLogStr}}	[]String	Returns QueryLog results as an array of strings. Index access for {{QueryLogStr[0]}} is not supported currently. Returns up to 1,000 raw logs, with a maximum total length of 10 KB.	If you need examples, see QueryLog variable.
{{QueryStartTime}}	Integer	Start time of the last execution statement in the alarm policy. Format: second-level Unix timestamp. For information on viewing execution statement numbers, see View execution statement number.	Configuration example: {{QueryStartTime}} Alarm notification example: 1699411640
{{QueryEndTime}}	Integer	The end time of the last execution statement in the alarm policy. Format: second-level Unix timestamp. For information on how to view execution statement numbers, see View execution statement number.	Configuration example: {{QueryEndTime}} Alarm notification example: 1699412200
{{Results}}	[]QueryData	Query parameters and intermediate results. Array type. The maximum array length is 3. For details, see QueryData structure.	Configuration example: The start time of the first query is {%set result0=Results[0]%}{{result0.StartTime}}, and the end time is {{result0.EndTime}}; the value of count is {{result0.RawResultsCount}}; the query and analysis statement is {{result0.Query}}. RawResults:{{toJson(result0.RawResults)}}, RawResultsCount:{{result0.RawResultsCount}}, FireResult:{{toJson(result0.FireResult)}}. Alarm notification example: The start time of the first query is 1701676139, and the end time is 1701677039; the value of count is 1; the query and analysis statement is \| select count() as cnt. RawResults:[{"cnt":"0"}], RawResultsCount:1, FireResult:{"cnt":"0"}.
{{FireResults}}	[]Object	The data that triggered the alarm, which is the result after the collection operation. Up to 100 items. If the actual length exceeds 2KB, the excess portion will be truncated.	Configuration example: The data that triggered the alarm is {{toJson(FireResults)}}. Alarm notification example: The data that triggered the alarm is [{"cnt":"0"}].
{{FireResultsCount}}	Integer	Total amount of data after collection operations on the results returned by query and analysis that trigger the alarm. May exceed 100.	Configuration example: Total number of records generated when the alarm is triggered: {{FireResultsCount}}. Alarm notification example: Total number of records generated when the alarm is triggered: 10.
{{SignInUrl}}	String	Link to the alarm details page. This link allows you to view alarm details, change the handler, and perform other related actions without signing in. For more details, see .	Configuration example: Click {{SignInUrl}} to view alarm details. Alarm notification example: Click https://console-embedded.volcanicengine.com/api/passport/login/loginWithSigninToken?signinToken=czVXb1M0djlpZ&redirectURI=%2Ftls%2Fregion%3Atls%2Bxxxxxxx to view alarm details.

QueryData structure

The Results variable represents query parameters and intermediate results. The following variables can be referenced.

Variable	Data type	Description	Example
TopicId	String	Target log topic ID for query and analysis.	fed25df2-cc27-4b0a-8ad2-773aef61****
Query	String	Query and analysis statement.	error \| select count(*) as errorCount
StartTime	Integer	Query start time. The format is a 10-digit Unix time stamp.	1699411640
EndTime	Integer	Specify the query end time. The format is a 10-digit Unix time stamp.	1699412200
RawResults	[]Object	Actual query results. Array format; up to 100 rows. If the actual length exceeds 2KB, the excess part will be truncated.	[{"cnt":"0"}]
RawResultsCount	Integer	The total number of actual query records may exceed 100.	1
FireResult	Object	The log content that triggered the alarm. Multiple original logs may trigger an alarm policy. This parameter only returns the first original log that triggers the alarm.	{"cnt":"0"}

QueryResult variable

Variable description

The QueryResult structure represents the execution results of queries when an alarm is triggered. The following configurations are supported:

Click Insert variable in the console. After clicking QueryResult, insert {{toJson(QueryResult)}}. This variable returns the complete query results matched by all (up to three) statements that exist currently in JSON format. The result may contain a large amount of irrelevant content.

Process the properties again using function syntax. Then only the specified fields of the query results return.

This variable is returned as an object. To access each property, use a period (.) to specify the property, such as {{log.name}}, {{log.name}}, or {{QueryResult[0][0].count}}.

Notice

The execution result of the query statement can also be returned as a String array ([]string). If needed, you can use the variable QueryResultStr.

Each execution statement returns up to 10 rows, with a maximum total length of 10 KB.

You can add up to three execution statements, with a maximum total length of 30 KB.

Example: Return a specified field variable

Return the specified field of the query results matched by all (up to three) statements.

{%-for Results in QueryResult%}
{%- for Result in Results%}
{{Result.name}}
{{Result.type}}
{{Result.double_key}}
{{Result.obj_key.key}}
{{Result['obj_key.key_double.data']}}
{%endfor-%}
{%endfor-%}

Return the specified field of the query result matched by the first statement in the first result.

{{QueryResult[0][0].name}}
{{QueryResult[0][0].type}}
{{QueryResult[0][0].double_key}}
{{QueryResult[0][0].obj_key.key}}
{{QueryResult[0][0]['obj_key.key_double.data']}}

Return the specified field of the query result matched by the second statement in the first result.

{{QueryResult[1][0].name}}
{{QueryResult[1][0].type}}
{{QueryResult[1][0].double_key}}
{{QueryResult[1][0].obj_key.key}}
{{QueryResult[1][0]['obj_key.key_double.data']}}

QueryResult content example:

[
[
{
"double_key": 1.1,
"name": "volcengine",
"obj_key": {
"key": 1,
"key_double": {
"data": 123
}
},
"type": 1
}
]
]

QueryLog variable

Variable description

The QueryLog structure represents the original log information matched by the query conditions in the statement, excluding any filters from the analysis statement. The following configurations are supported:

Insert variables directly in the console by clicking Insert variable. After clicking QueryLog, insert {{toJson(QueryLog)}}. This variable returns the complete original log information matched by all (up to three) execution statements in JSON format, which may contain a large amount of irrelevant content.

Use function syntax to further process the attributes and return only specified fields of the original log information.

The QueryLog variable returns as a two-dimensional object array. Normally, each field should be accessed by specifying the field using a period (.), such as {{log.name}} or {{log.name}}. If the field name contains spaces, use the format {{log['']}}, for example: {{log['key name']}}.

Notice

The original log corresponding to QueryLog can also be returned as a string array. If needed, you can use the variable QueryLogStr.

Each execution statement returns up to 1,000 raw logs, with a maximum total length of 10 KB.

You can add up to three execution statements, with a maximum total length of 30 KB.

Variable examples for returning specified fields of the original log

Notification content configuration example:

Return specified fields of the original log information matched by all (up to 3) execution statements.

{%-for logs in QueryLog%}
{%- for log in logs%}
{{log.name}}
{{log.type}}
{{log.double_key}}
{{log.obj_key.key}}
{{log['obj_key.key_double.data']}}
{%endfor-%}
{%endfor-%}

Return the specified field of the original log entry matched by the first execution statement’s first entry.

{{QueryLog[0][0].name}}
{{QueryLog[0][0].type}}
{{QueryLog[0][0].double_key}}
{{QueryLog[0][0].obj_key.key}}
{{QueryLog[0][0]['obj_key.key_double.data']}}

Return the specified field of the original log entry matched by the second execution statement’s first entry.

{{QueryLog[1][0].name}}
{{QueryLog[1][0].type}}
{{QueryLog[1][0].double_key}}
{{QueryLog[1][0].obj_key.key}}
{{QueryLog[1][0]['obj_key.key_double.data']}}

Example of QueryLog content:

[
[
{
"double_key": 1.1,
"name": "volcengine",
"obj_key": {
"key": 1,
"key_double": {
"data": 123
}
},
"type": 1
}
]
]

Filter

TLS alarm variables support adding filters. Filters use chaining to further process variable data.

Format: {{variable|filter}}.

Example: Add the escape filter for Unicode encoding.

Example value	Field	Output result
Variable	{{toJson(FireResults)}}	{"a":123,"b":123}
Add filter	{{toJson(FireResults)\|escapejs}}	\u007b\u0022\u0061\u0022\u003a\u0031\u0032\u0033\u002c\u0022\u0062\u0022\u003a\u0031\u0032\u0033\u007d

Filter list

Filter	Description	Example
escape	Automatically escape special characters. If special characters that should be escaped are not escaped in the received alarm notifications, this filter can be used to forcefully escape all output content of specified strings or specified variables.	Reference example: {{"<script>"\|escape}} Processing result: <script>
escapejs	Encode special characters using Unicode. If alarm notification content contains special characters that require Unicode encoding, you can use this filter to encode the special characters in specific strings or variables with Unicode. For more details, see Alarm notification content contains special characters, how to deal with it?.	Reference example: {{"<script> alert('hello')</script>"\|escapejs}} Processing result: \u003Cscript\u003E alert\u0028\u0027hello\u0027\u0029\u003C/script\u003E

Filter example

The following example shows how to add operation set data, operation set count, query results, and a link to the login-free alarm details page in an alarm notification. The query results section returns detailed information, including query results, log topic ID, and query statement details.

Last updated: 2026.04.14 10:38:09