Custom Alert: Log Event Detection

[apanoobee]

I have set up a custom alert but I'd like to be able to display a specific number string to the alert description. How would I go about doing this?

[sujit_k_singh]

Hi @apanoobee 

Extract the field - In your log event query, use parse or extract to pull the specific number/string into a named field. For example:

fetch logs
| filter contains(content, "exception:A record could not be deleted")
| parse content, "LD 'ticketId:' STRING:ticketId"

Use the extracted field in the Event Template - In your Log Event configuration under Event Template → Description, you can reference extracted fields using curly brace placeholders:

Child records found: integrity constraint violated - Ticket ID: {ticketId}

Ensure the field is available as an event property - Under the Properties section of your log event configuration, add the extracted field (ticketId) as a custom property. This makes it available for use in the alert title and description templates.

Thanks,

Sujit