Skip to content

ThousandEyes の Custom Webhook で用意されているデフォルトテンプレート

ThousandEyes でアラートを検知した際、通知先として電子メール以外にも Custom Webhooks を設定することで宛先に Cisco Webex や Microsoft Teams を選択することが出来ます。 Custom Webhook を作成する際、Preset Configurations を利用することで Webhook で利用するデータ部分をテンプレートから選択出来ます。 今回は現時点で用意されているテンプレートの種類と内容をメモしておきます。

Preset Configurations の選択画面

Add Custom Webhook Integration から Preset Configurations をクリックすると選択可能なテンプレートが表示されます。

file

現時点では以下の 6 種類でした。 AppDynamics のみ、URL Query Parameters を利用していましたが、その他は Body を利用していました。

No. Type URL Query Parameters Body
1 Generic - ◯
2 AppDynamics ◯ -
3 Cisco Webex - ◯
4 Microsoft Teams - ◯
5 Slack - ◯
6 Splunk - ◯

Generic (Body)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
{
    "id": "{{id}}",
    "type": "{{type.id}}",
    "alert": {
        "id": "{{alert.id}}",
        "type": "{{alert.rule.alertType.id}}",
        "severity": "{{alert.severity.id}}",
        {{#if alert.test}}
        "test": {
            "name": "{{alert.test.name}}",
            "labels": [
                {{#each alert.test.labels}}
                    "{{name}}"{{#unless @last}}, {{/unless}}
                {{/each}}
            ]
        },
        "targets": [
            {{#each alert.targets}}
            "{{description}}"{{#unless @last}}, {{/unless}}
            {{/each}}
        ],
        {{/if}}
        {{#with alert.rule as | rule |}}
        "rule": {
            "id": "{{rule.id}}",
            "name": "{{rule.name}}",
            "expression": "{{formatExpression rule.expression}}",
            "notes": "{{rule.notes}}"
        },
        {{/with}}
        "triggered": {{alert.firstSeen.epochMilli}},
        {{#if alert.timeCleared}}
        "cleared": {{alert.timeCleared.epochMilli}},
        {{/if}}
        "details": [
            {{#each alert.details}}
                {
                    "metricsAtStart" : "{{metricsAtStart}}",
                    {{#if metricsAtEnd}}
                    "metricsAtEnd" : "{{metricsAtEnd}}",
                    {{/if}}
                    "source" : {
                        "id": "{{source.id}}",
                        "name": "{{source.name}}"
                        {{#if source.asn}}
                        , "asn": "{{source.asn.name}}"
                        {{/if}}
                    }
                }
                {{#unless @last}}, {{/unless}}
            {{/each}}
        ]
    }
}

AppDynamics (URL Query Parameters)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
{
    "summary": "ThousandEyes: Alert {{#eq type.id 1}}Cleared{{else}}Triggered{{/eq}} - {{alert.rule.name}}",
    "comment": "<strong>Alert {{#eq type.id 1}}Cleared{{else}}Triggered{{/eq}}</strong><br><strong>Alert ID:</strong> {{alert.id}}{{#if alert.test}}<br><strong>Test:</strong> {{alert.test.name}}{{/if}}<br><strong>Alert Rule:</strong> {{alert.rule.name}} - {{alert.rule.expression}}",
    "severity": "{{#eq type.id 1}}INFO{{else}}WARN{{/eq}}",
    "tier": null,
    "node": null,
    "bt": null,
    "eventtype": "CUSTOM",
    "customeventtype": "ThousandEyesAlert",
    "propertynames": "alertType",
    "propertynames": "alertState",
    "propertyvalues": "{{alert.rule.alertType.id}}",
    "propertyvalues": {{type.id}}
}

Cisco Webex (Body)

1
2
3
{
"markdown" : "<strong>ThousandEyes Alert{{#eq type.id 2}} Triggered{{else}} Cleared{{/eq}}{{#if alert.test}} for {{alert.test.name}}{{/if}}</strong>\n<strong>Alert ID:</strong> {{alert.id}}{{#if alert.test}}\n<strong>Test Name:</strong> {{alert.test.name}}\n<strong>Target/s:</strong> {{#each alert.targets}}{{description}}{{#unless @last}} {{/unless}}{{/each}}{{/if}}\n<strong>Alert Rule:</strong> {{alert.rule.name}} - {{formatExpression alert.rule.expression}}{{#if alert.details}}\n<strong>Details:</strong> {{alert.details.size}}{{/if}}\n<strong>Severity:</strong> {{alert.severity.display}}\n<strong>Alerts Link:</strong> https://app.thousandeyes.com/alerts/list/active"
}

Microsoft Teams (Body)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
{
    "@type": "MessageCard",
    "@context": "http://schema.org/extensions",
    "themeColor": "{{#eq type.id 2}}800000, {{else}}00cc00 {{/eq}}",
    "summary": "ThousandEyes Alert Notification",
    "sections": [{
        "activityTitle": "Alert{{#eq type.id 2}} Triggered{{else}} Cleared{{/eq}}{{#if alert.test}} for {{alert.test.name}}{{/if}}",
        "activitySubtitle": "ThousandEyes Alert Service",
        "activityImage": "https://app.thousandeyes.com/static/images/logo_128x128.png",
        "facts": [{
                "name": "Alert ID",
                "value": "{{alert.id}}"
            }, {{#if alert.test}} {
                "name": "Test Name",
                "value": "{{alert.test.name}}"
            }, {{/if}} {{#if alert.test}} {
                "name": "Domain",
                "value": "{{#each alert.targets}}{{description}}{{#unless @last}}, {{/unless}}{{/each}}"
            }, {{/if}} {
                "name": "Alert Rule",
                "value": "{{alert.rule.name}} - {{formatExpression alert.rule.expression}}"
            }, {{#if alert.details}} {
                "name": "Details",
                "value": "{{alert.details.size}}"
            }, {{/if}} {
                "name": "Severity",
                "value": "{{alert.severity.display}}"
            }],
            "markdown": true
        }],
        "potentialAction": [ {
            "@type": "OpenUri",
            "name": "Open Alerts Link",
            "targets": [{
            "os": "default",
            "uri": "https://app.thousandeyes.com/alerts/list/active"
        }]
    }]
}

Slack (Body)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
{
    "channel": "#thousandeyes-alert-notifications",
    "attachments": [{
        {{#eq type.id 2}}
        "color": "danger",
        {{else}}
        "color": "good",
        {{/eq}}
        "title": "Alert{{#eq type.id 2}} Triggered{{else}} Cleared{{/eq}}{{#if alert.test}} for {{alert.test.name}}{{/if}}",
        "title_link": "https://app.thousandeyes.com/alerts/list/active",
        "fallback": "ThousandEyes Alert",
        "text": "*Alert ID*: {{alert.id}}{{#if alert.test}}\n*Test Name*: {{alert.test.name}}\n*Target/s*: {{#each alert.targets}}{{description}}{{#unless @last}}, {{/unless}}{{/each}}{{/if}}\n*Alert Rule*: {{alert.rule.name}} - {{formatExpression alert.rule.expression}}{{#if alert.details}}\n*Details*: {{alert.details.size}}{{/if}}",
        "mrkdwn_in": [ "text" ],
        "ts": {{alert.firstSeen.epochMilli}},
        "footer": "ThousandEyes Alerts",
        "footer_icon": "https://app.thousandeyes.com/static/images/logo_128x128.png"
    }],
    "username": "ThousandEyes",
    "icon_url": "https://app.thousandeyes.com/static/images/logo_128x128.png"
}

Splunk (Body)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
{
    "event": {
        "eventId": "{{id}}-{{alert.id}}",
        "eventType": "THOUSANDEYES_ALERT_NOTIFICATION",
        "id": "{{id}}",
        "type": "{{type.id}}",
        "alert": {
            "id": "{{alert.id}}",
            "type": "{{alert.rule.alertType.id}}",
            "severity": "{{alert.severity.id}}",
            {{#if alert.test}}
            "test": {
                "name": "{{alert.test.name}}"
            },
            "targets": [
                {{#each alert.targets}}
                "{{description}}"{{#unless @last}}, {{/unless}}
                {{/each}}
            ],
            {{/if}}
            {{#with alert.rule as | rule |}}
            "rule": {
                "id": "{{rule.id}}",
                "name": "{{rule.name}}",
                "expression": "{{formatExpression rule.expression}}",
                "notes": "{{rule.notes}}"
            },
            {{/with}}
            "triggered": {{alert.firstSeen.epochMilli}},
            {{#if alert.timeCleared}}
            "cleared": {{alert.timeCleared.epochMilli}},
            {{/if}}
            "details": [
                {{#each alert.details}}
                    {
                        "metricsAtStart" : "{{metricsAtStart}}",
                        {{#if metricsAtEnd}}
                        "metricsAtEnd" : "{{metricsAtEnd}}",
                        {{/if}}
                        "source" : {
                            "id": "{{source.id}}",
                            "name": "{{source.name}}"
                            {{#if source.asn}}
                            , "asn": "{{source.asn.name}}"
                            {{/if}}
                        }
                    }
                    {{#unless @last}}, {{/unless}}
                {{/each}}
            ]
        }
    }
}