Incidents and on-call/Alerting/Alert templates

Alert templates

Reusable alert-rule definitions so the same check does not get written slightly differently ten times.

Incidents & On-Call → Alert Templates holds rule definitions you can apply to many services at once.

Why they exist

The tenth service to be onboarded gets a slightly different disk-space rule from the first one, because somebody typed it again from memory. Six months later nobody can say which threshold is the intended one.

A template makes the definition the shared object: thresholds, For, recovery, severity, message and routing live in one place, and every rule created from it starts identical.

Creating one

A template carries everything a rule does, minus the subject:

the condition and thresholds
For, recovery and cooldown
severity, and a warn threshold if the check supports one
the message template
default routing

Applying

Apply a template to a service, a group of services, or every service matching a tag. Each application creates a real rule — which means a rule can be adjusted afterwards for one service without affecting the others.

Note

Applying a template creates rules; it does not create a live link. Editing the template later does not rewrite rules already created from it. This is deliberate: a silent mass edit of live alerting is not something a UI should do without showing you what will change.

Message templates

The message supports placeholders so an alert says something specific:

Placeholder	Becomes
`{value}`	The measured value
`{threshold}`	The threshold that decided
`{rule}`	The rule name
`{connection}`	The data source
`{group}`	The subject, for per-row rules

A good alert message says what was measured, what it was compared against, and what the reader should do. "CPU high" says none of those.