Overview

When writing message templates, the $event you reference is Nightingale’s internal alert-event struct AlertCurEvent (source: models/alert_cur_event.go). An alert carries this object all the way from triggering and aggregation to sending, and the template can access all of its fields.

This page lists those fields grouped by purpose so you can pick what you need when writing templates.

Two field-name styles — don’t mix them up

The same field has two names, used in different places:

Scenario	Style	Example
Message template / Go template (focus of this doc)	Go field name (camelCase)	{{$event.RuleName}}
Raw event JSON forwarded by Callback / Webhook	JSON field name (snake_case)	rule_name

⚠️ In templates you must use the Go field name $event.RuleName; $event.rule_name returns nothing. Each table below gives both names.

Also, fields marked json:"-" (e.g. Tags, Annotations) do not appear in the Webhook JSON, but are still accessible in templates via the Go field name.

Top-level variables available in templates

When a message template is rendered, the platform presets a few shortcut variables (see getDefs in models/message_tpl.go):

Variable	Equivalent to	Description
$events	.events	All events in this notification (multiple when aggregated); can be ranged
$event	index $events 0	The first event (most templates only use this)
$labels	$event.TagsMap	Alias for the tag map
$value	$event.TriggerValue	Alias for the trigger value
.domain	site URL	The access URL injected by the platform, used to build detail/mute links

For aggregated notifications (one message carrying multiple alerts), use {{range $events}}...{{end}}; $event is only the first one.

---

1. Identity & Data Source

Template syntax	JSON field	Type	Description
$event.Id	id	int64	Event ID, used to build the detail link: {{.domain}}/alert-his-events/{{$event.Id}}
$event.Cate	cate	string	Data source type: prometheus / host / mysql / elasticsearch / loki, etc. Built-in templates use it to decide whether to show the “view graph” link ({{if eq $event.Cate "prometheus"}})
$event.Cluster	cluster	string	Data source name
$event.DatasourceId	datasource_id	int64	Data source ID
$event.GroupId	group_id	int64	Business group ID
$event.GroupName	group_name	string	Business group name
$event.Hash	hash	string	Unique event identifier (rule_id + tag vector); events of the same rule with the same tag set share the same hash; used for dedup/aggregation
$event.RuleHash	rule_hash	string	Rule hash

2. Rule Info

Template syntax	JSON field	Type	Description
$event.RuleName	rule_name	string	Rule name (most used)
$event.RuleNote	rule_note	string	Rule note
$event.RuleId	rule_id	int64	Rule ID
$event.RuleProd	rule_prod	string	Monitoring type: metric / host / anomaly / loki, etc.
$event.RuleAlgo	rule_algo	string	Algorithm (set for anomaly detection; empty for threshold alerts)
$event.PromQl	prom_ql	string	The query that triggered this event
$event.PromForDuration	prom_for_duration	int	Duration for (seconds)
$event.PromEvalInterval	prom_eval_interval	int	Evaluation interval (seconds)
$event.RunbookUrl	runbook_url	string	Runbook / troubleshooting guide link
$event.RuleConfigJson	rule_config	object	Parsed full rule config object
$event.RuleConfig	(not serialized, json:"-")	string	Raw JSON string of the rule config

3. Severity & Status

Template syntax	JSON field	Type	Description
$event.Severity	severity	int	Alert severity: 1 = Emergency / 2 = Warning / 3 = Notice (lower number = more severe)
$event.IsRecovered	is_recovered	bool	Whether it’s a recovery event (true=recovered, false=triggered) ★ most used in conditionals / color switching
$event.NotifyRecovered	notify_recovered	int	Whether the rule enables recovery notifications (1=yes)
$event.NotifyCurNumber	notify_cur_number	int	Which notification this is (repeat-reminder counter)
$event.Status	status	int	Event status
$event.Claimant	claimant	string	Claimant

4. Trigger Value & Time

Time fields are all Unix seconds; render with {{timeformat $event.XxxTime}}.

Template syntax	JSON field	Type	Description
$event.TriggerValue	trigger_value	string	The value at trigger time ($value is its alias)
$event.TriggerValues	trigger_values	string	Trigger-value string for multi-query scenarios
$event.TriggerValuesJson.ValuesWithUnit	trigger_values_json	map	Trigger values with units: key is the query ref, value has Value / Unit / Text / Stat. Use .Text for the formatted text
$event.TriggerTime	trigger_time	int64	Trigger timestamp
$event.FirstTriggerTime	first_trigger_time	int64	First trigger time of a continuous alert (use to compute “how long it has lasted”)
$event.FirstEvalTime	first_eval_time	int64	Time the anomaly was first detected
$event.LastEvalTime	last_eval_time	int64	Last evaluation time; in a recovery event this is the recovery time
$event.LastSentTime	last_sent_time	int64	Last notification send time
$event.RecoverTime	recover_time	int64	Recovery time (recovery event)

5. Tags & Annotations

Template syntax	JSON field	Type	Description
$event.TagsMap	tags_map	map[string]string	Tag map ★ most used, e.g. $event.TagsMap.instance; $labels is its alias
$event.TagsJSON	tags	[]string	Tag array ["k=v", ...], can be ranged
$event.OriginalTagsJSON	original_tags	[]string	Original tags before relabel
$event.AnnotationsJSON	annotations	map[string]string	Annotation map, e.g. $event.AnnotationsJSON.summary
$event.Tags / $event.Annotations / $event.OriginalTags	(json:"-")	string	DB storage form, rarely used directly in templates

6. Notification Config

These come from the rule config; some are legacy notification fields. In new (notification-rule-based) setups, mainly look at NotifyRuleId / NotifyRuleName.

Template syntax	JSON field	Type	Description
$event.NotifyRuleId	notify_rule_id	int64	Matched notification rule ID (new)
$event.NotifyRuleName	notify_rule_name	string	Matched notification rule name (new)
$event.NotifyRuleIds	notify_rule_ids	[]int64	Associated notification rule ID list
$event.NotifyVersion	notify_version	int	0=legacy, 1=new notification
$event.CallbacksJSON	callbacks	[]string	Callback URLs
$event.NotifyChannelsJSON	notify_channels	[]string	Notification channels (legacy)
$event.NotifyGroupsJSON	notify_groups	[]string	Notification group IDs (legacy)
$event.NotifyGroupsObj	notify_groups_obj	[]UserGroup	Notification group objects
$event.NotifyUsersObj	notify_users_obj	[]User	Notification user objects

7. Target Host

Template syntax	JSON field	Type	Description
$event.TargetIdent	target_ident	string	Monitored object identifier (host ident)
$event.TargetNote	target_note	string	Object note
$event.Target	target	object	Full object info, including HostIp / OS / CpuNum / MemUtil / GroupNames, etc., e.g. $event.Target.HostIp

8. Advanced / Extended Fields

Template syntax	JSON field	Type	Description
$event.RecoverConfig	recover_config	object	Recovery-judgment config, includes JudgeType / RecoverExp
$event.SubRuleId	sub_rule_id	int64	Sub-rule ID
$event.ExtraInfo	extra_info	[]string	Extra info
$event.ExtraInfoMap	extra_info_map	[]map[string]string	Structured extra info
$event.ExtraConfig	extra_config	object	Extra config
$event.ShotImageBase64	shot_image_base64	map[string]string	Snapshot / curve image base64 (for card images)

---

Common Snippets

Title: recovered/triggered + severity + rule name

{{if $event.IsRecovered}}💚 Recovered{{else}}💔 S{{$event.Severity}} Alert{{end}}: {{$event.RuleName}}

Body: color by severity (DingTalk markdown)

#### {{if $event.IsRecovered}}<font color="#008800">💚 {{$event.RuleName}}</font>{{else}}<font color="#FF0000">💔 {{$event.RuleName}}</font>{{end}}
- **Severity**: {{if eq $event.Severity 1}}Emergency{{else if eq $event.Severity 2}}Warning{{else}}Notice{{end}}
- **Business Group**: {{$event.GroupName}}
{{- if $event.RuleNote}}
- **Note**: {{$event.RuleNote}}
{{- end}}
{{- if not $event.IsRecovered}}
- **Trigger Value**: {{$event.TriggerValue}}
- **Trigger Time**: {{timeformat $event.TriggerTime}}
{{- else}}
- **Recovery Time**: {{timeformat $event.LastEvalTime}}
{{- end}}

Duration so far

{{$duration := sub now.Unix $event.FirstTriggerTime}}{{if $event.IsRecovered}}{{$duration = sub $event.LastEvalTime $event.FirstTriggerTime}}{{end}}Lasted: {{$duration}} seconds

Iterate tags

{{- range $key, $val := $event.TagsMap}}
- {{$key}}: {{$val}}
{{- end}}

Get a single tag (with nil-check to avoid <no value>)

Host: {{if $event.TagsMap.instance}}{{$event.TagsMap.instance}}{{else}}unknown{{end}}

Detail / Mute / Graph links

[Event Detail]({{.domain}}/share/alert-his-events/{{$event.Id}}) | [Mute 1h]({{.domain}}/alert-mutes/add?__event_id={{$event.Id}}){{if eq $event.Cate "prometheus"}} | [View Graph]({{.domain}}/metric/explorer?__event_id={{$event.Id}}&mode=graph){{end}}

Aggregated notification: iterate multiple events

{{len $events}} alerts in total:
{{range $i, $e := $events}}{{add $i 1}}. {{$e.RuleName}} | {{$e.TagsMap.instance}} | {{$e.TriggerValue}}
{{end}}

Notes

• Wrong name → empty value: use Go field names in templates ($event.RuleName), not JSON names (rule_name).
• Missing fields render as <no value>: add {{if ...}} nil-checks when reading tags/annotations, or inject defaults via label mapping.
• Format the time: all *Time fields are Unix seconds; printed directly they’re just numbers — use {{timeformat ...}}.
• $event is only the first one: for aggregated notifications, iterate $events.
• Field cache: after editing a template, wait 10–30s before triggering — templates are cached for a few seconds.

References

• Message Templates — template creation, field identifiers, clone & customize
• Template Functions — available functions like timeformat / sub / formatDecimal
• models/alert_cur_event.go — event struct source (fields are authoritative here)
• Go template syntax