topic Re: Assistance Required for Formatting DQL Query Results in Email in DQL

Assistance Required for Formatting DQL Query Results in Email

aninda — Tue, 17 Jun 2025 08:22:16 GMT

Hello Team,

I am currently working on sending the results of a DQL query via email. For this purpose, I have created the following workflow:

The workflow is functioning as expected, and the emails are being received. However, the data in the email is not formatted properly. Below is a snapshot of the data that is being received:

I would like to know if there is a way to present this data in a tabular format. The DQL query being used is as follows:

fetch logs
| filter matchesPhrase(index, "<index name>")
| filter matchesPhrase(content,"- ERROR -")
| filter contains(source,"<keyword>")
| fieldsAdd container_name = splitString(source,"/")[-2]
| fieldsAdd interface_name_temp = splitString(source, "/")[-1]
| fieldsAdd interface_name = splitString(interface_name_temp,".")[0]
| fieldsAdd event_date = formatTimestamp(timestamp, format:"dd-MM-yyyy")
| fields event_date, container_name, interface_name, source, content

Re: Assistance Required for Formatting DQL Query Results in Email

ChadTurner — Mon, 16 Jun 2025 11:38:29 GMT

Can you provide a screen shot of what you have defined out in the email segment of the workflow?

Re: Assistance Required for Formatting DQL Query Results in Email

aninda — Mon, 16 Jun 2025 11:40:16 GMT

Hi Chad,

I have defined the below in the email segment:

Re: Assistance Required for Formatting DQL Query Results in Email

ChadTurner — Mon, 16 Jun 2025 11:50:28 GMT

I would recommend using a similar format as how custom events for alerting works where you leverage Placeholders to provide dynamic variable data like " Host {Host.Name} reported high CPU with a value above {Baseline}. "

Granted that is not the value you will use, but it showcases the mind set of using dynamic variables you set within your grail query. Much like you did for {Record}. You can also use the right hand tab to test the result to verify the data is properly formatted without spamming emails.

Re: Assistance Required for Formatting DQL Query Results in Email

marco_irmer — Mon, 16 Jun 2025 17:41:20 GMT

Hi there. One limitation you will need to keep in mind is that sending email with Workflows currently only supports plain text, as mentioned in the documentation. You will need to format the body of your email accordingly so that it generates a legible message body within the constraints of plain text. That formatting would likely live inside the loop (between lines #1 and #3) and involve a mix of actual text and specific values from your results.

Re: Assistance Required for Formatting DQL Query Results in Email

marco_irmer — Wed, 09 Jul 2025 21:25:28 GMT

Updating this thread with availability of email formatting as of SaaS release 1.318.