topic Monday morning question about Anomaly detection {} in Alerting

Monday morning question about Anomaly detection {}

henk_stobbe — Mon, 23 Mar 2026 07:15:01 GMT

Good morning,

So you have a title where you can not use {}

A description you can not use {}

And a event description where you can use {}

I assume the the first two are just for documentation purposes?

Title -> high usage of xxx

Description -> created by me on behave of the customer

And the last one is describing the issue?

Event -> this event is triggered by {device} ...

Could this be the best practice, or am I completely wrong (-;

KR Henk

Re: Monday morning question about Anomaly detection {}

rastislav_danis — Mon, 23 Mar 2026 09:36:27 GMT

Yes, you are right, first two are only for alert definition description.

Re: Monday morning question about Anomaly detection {}

t_pawlak — Mon, 23 Mar 2026 10:00:25 GMT

That’s correct, I would just add a bit more context here.

it looks like this:

Title – static alert title, no support for {}
Description – static configuration / documentation field, also without {}
Event name / Event description – dynamic part, where placeholders {} can be used

So in practice:

Title is used to clearly identify the alert rule in the configuration
Description is a good place for documentation, for example the purpose, owner, or scope of the alert
Event name and Event description describe the actual event that will be created when the condition is violated

You could configure it like this:
Title: High usage of something
Description: Custom alert created by henk to detect something
Event name: High usage detected on {host}
Event description: This event was triggered because an anomaly was detected on {host} for metric {metricname}