- [SEARCH_QUERY] = By default, the search query used in the search monitor is presented in the alert's subject. Occasionally, the search query may be long so it is possible to include this placeholder in the email body which will be replaced upon execution with the query.
- [END_OF_SUBJECT] = Used in the end of the message subject in case there is a need to exclude the search query from the subject.
- [COLUMN_NAME] = the name of the column which its content will be included
- [MONITOR_ID] = the unique id of the monitor
- [MONITOR_NAME] = the name of the monitor
- [MONITOR_STATUS] = the monitor status : 1 = failure , 0 = success
- [LOG_NAME] = the log name that the included event is originated from
- [LOG_ID] = the log name that the included event is originated from
- [HOST_NAME] = the host name that the included event is originated from
- [APPTAGS] = the application(s) name(s) that the monitor is associated with
- [FOLDER_NAME] = the parent folder name that the included event is originated from
- [ALL_TABLE_CSV] = may be used in complex query result to display the entire result table in CSV format. This placeholder is not required in email alert as the result table is displayed by default.
It is very important when publishing alerts to Slack, MS Teams and Pagerduty in order to see on the target the contents of the result.