Hello Team, I'd like to ask what's the best place to learn more about the destination template E.g. if in logs we receive the following test message: { _timestamp: Sep 24, 2026 140350.030 +0200, job: PoC-notifications, level: info, log: PoC Test alarm - there is nothing to worry about. } How may I pass 'job', 'level' and 'log' to be useable in the destination templates, please? I mean parameter handover just like the additional variables at the alert definition.

Hi! 👋 Best place to start is the templates docs: openobserve.ai/docs/user-guide/management/templates Good news: you don't need to hand over

job

,

level

, or

log

yourself. All fields from the alert's query result are automatically available in templates. Just use them as placeholders:

{
  "text": "[{level}] {job}: {log}"
}

A few things to know: • SQL alerts: only the columns you

SELECT

are available, so make sure

job, level, log

are in the query (or use

SELECT *

). • Multiple matching events: use a row template in the alert's Advanced settings, e.g.

[{level}] {job}: {log}

, and then put

{rows}

in the destination template to get one line per event.

{rows:5}

limits it to the first 5. • Long messages:

{log:200}

cuts the value off at 200 characters. • Built-in variables like

{alert_name}

,

{stream_name}

,

{alert_start_time}

, and

{alert_url}

work alongside your fields. • Additional Variables in the alert definition are for fixed values you set per alert (a team name, a runbook link, and so on), not for log fields. Full example:

{
  "text": "Alert {alert_name} on {stream_name}\n{rows:5}\n{alert_url}"
}

with the row template

[{level}] {job}: {log}

.

Thank you, the helping part was to use the SQL way of alarm definition. Now it works like magic