Skip to main content
Sumo Logic

Monitor Variables

This document outlines the variables you can use as parameters in the JSON payload object of your notifications. Variables must be enclosed by double curly brackets.

Payload variables for monitors

You can use the following variables when specifying the notification payload for log or metric monitors.

Variable Description 

 {{Name}}

The name of the monitor. In the delivered payload, this variable is replaced with the Name you assigned to the monitor when you created it.

 {{Description}}

The description of the monitor. In the delivered payload, this variable is replaced with the Description you assigned to the monitor when you created it.

{{MonitorType}}

The type of monitor, either Logs or Metrics.

 {{Query}}

The query used to run the monitor. In the delivered payload, this variable is replaced by your log or metric query.

{{QueryURL}}

The URL link to the search or metrics query. In the delivered payload, this is a URL that you can click to run the saved search or metric query.

{{ResultsJson}}

JSON object containing the query results that triggered the alert.

{{NumQueryResults}}

The number of results the query returned.

{{Id}}

The identifier of the triggered alert.

{{DetectionMethod}}

The condition that triggered the alert. For example, above 90 at least once in the last 5 minutes.

{{TriggerType}}

The status of the monitor, either Normal, Critical, Warning, or Missing Data.

{{TriggerTimeRange}}

The time range that triggered the monitor to send the notification. In the delivered payload, this variable will be replaced by the time range for the log or metric query.

{{TriggerTime}}

The start time of the log or metric query that triggered the notification.

{{TriggerCondition}}

The condition that triggered the alert.

{{TriggerValue}}

The value of the trigger condition.

{{TriggerTimeStart}}

When the trigger condition was met.

{{TriggerTimeEnd}}

When the trigger condition was resolved.