Custom Alert: Log Event Detection

apanoobee — Tue, 19 May 2026 12:18:17 GMT

I have set up a custom alert but I'd like to be able to display a specific number string to the alert description. How would I go about doing this?

Re: Custom Alert: Log Event Detection

sujit_k_singh — Thu, 18 Jun 2026 01:46:27 GMT

Hi @apanoobee

Extract the field - In your log event query, use parse or extract to pull the specific number/string into a named field. For example:

fetch logs
| filter contains(content, "exception:A record could not be deleted")
| parse content, "LD 'ticketId:' STRING:ticketId"

Use the extracted field in the Event Template - In your Log Event configuration under Event Template → Description, you can reference extracted fields using curly brace placeholders:

Child records found: integrity constraint violated - Ticket ID: {ticketId}

Ensure the field is available as an event property - Under the Properties section of your log event configuration, add the extracted field (ticketId) as a custom property. This makes it available for use in the alert title and description templates.

Thanks,

Sujit

topic Re: Custom Alert: Log Event Detection in Alerting

Custom Alert: Log Event Detection

Re: Custom Alert: Log Event Detection