Alerts — Webhook

Post a JSON payload to any URL the moment a log entry matches your conditions.

About alerts

An alert watches your incoming log stream and fires a notification whenever an entry matches all of its conditions. Each alert can have multiple delivery channels. Use the Test button to fire a sample notification immediately, and the Alert Log to review delivery history.

Match conditions

Condition	How it matches
Logspace	Restrict to a specific logspace, or leave blank to match all.
Level	Exact match — e.g. ERROR only fires on error-level entries.
Program contains	Case-insensitive substring match on the program field.
Message contains	Case-insensitive substring match on the message field.

Setup

1. Go to Alerts and click New Alert (or edit an existing one).
2. Select Webhook as the channel type.
3. Enter the target URL.
4. Optionally customise the JSON body using the placeholders below.

Default payload

{"level": "{level}", "message": "{message}", "program": "{program}", "timestamp": "{timestamp}", "logspace": "{logspace}", "uuid": "{uuid}"}

Placeholders

Placeholder	Value
{level}	Log level (e.g. ERROR)
{message}	Log message text
{program}	Program / source name
{timestamp}	ISO 8601 timestamp of the log entry
{logspace}	Name of the logspace
{uuid}	UUID of the logspace

Examples

PagerDuty Events API v2

{"routing_key": "YOUR_PAGERDUTY_KEY", "event_action": "trigger", "payload": {"summary": "{message}", "severity": "error", "source": "{program}"}}

Slack incoming webhook

{"text": "[{level}] {program}: {message}"}

Generic JSON API

{"alert": true, "level": "{level}", "text": "{message}", "source": "{program}", "ts": "{timestamp}"}

Notes

• The payload is sent as an HTTP POST with Content-Type: application/json.
• Any 2xx response is treated as success. Non-2xx responses are logged as failures in the Alert Log.
• To reach services like WhatsApp or SMS, see the IFTTT / WhatsApp page.