Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.flashcat.cloud/llms.txt

Use this file to discover all available pages before exploring further.

Use an alert rule Description to define the text shown on firing and recovery events. You can reference alert labels, query values, related query results, and safe Sprig functions with Go text/template, then render the result as Text or Markdown.
The template variables, Sprig function names, and behavior where label enrichment runs before Description rendering require monit-edge v0.42.0 or later. On older versions, some variables or functions may be unavailable, and enrichment results may not be available inside Description templates.

How It Works

When a rule fires or recovers, monit-edge passes the full alert event as the template root object and injects short variables for common fields. After label enrichment completes, monit-edge renders the template with the enriched event, writes the result to the event Description, and then sends the event.
For day-to-day templates, prefer $labels, $values, $value, $relates, $status, and $checkMode. Use the other short variables only for advanced templates or compatibility cases.

Sprig Function Names

monit-edge registers safe Sprig functions with their standard Sprig names. The same supported functions are also registered with a sprig_ prefix so templates can avoid naming conflicts when needed. Use:
{{ contains "Unknown column" $msg }}
{{ regexMatch "Unknown column" $msg }}
{{ regexFind "Unknown column '[^']+'" $msg }}
The prefixed form is also valid:
{{ sprig_contains "Unknown column" $msg }}
{{ sprig_regexMatch "Unknown column" $msg }}
{{ sprig_regexFind "Unknown column '[^']+'" $msg }}
If a standard Sprig name conflicts with a monit-edge custom function, the monit-edge custom function keeps the standard name and the Sprig function remains available through the sprig_ prefix.

Built-in Variables

VariableTypeDescription
$labelsmap[string]stringAlert labels. Same data as .DataLabels.
$valuesmap[string]float64Numeric values used by alert evaluation. Same data as .Values.
$valuefloat64Main alert value. Same data as .Value.
$appendLabelsmap[string]stringExtra labels configured on the alert rule.
$annotationsmap[string]stringRule annotations.
$dsTypestringData source type.
$dsNamestringData source name.
$dsAddressstringData source address without credentials.
$checkModestringCheck mode.
$relatesmap[string][]*ResultRowRelated query result rows.
$statusstringfiring or recovered.
$severitystringAlert severity.
Example:
{{- if eq $status "firing" }}
Alert {{ .RuleName }} fired on {{ $dsName }}. Value: {{ printf "%.2f" $value }}
{{- else }}
Alert {{ .RuleName }} recovered.
{{- end }}

Root Object Fields

Access root object fields with .FieldName.
FieldTypeDescription
.HashstringStable event hash. Firing and recovery events share the same hash.
.DataSourceTypestringData source type.
.DataSourceNamestringData source name.
.DataSourceAddressstringData source address without credentials.
.RuleNamestringAlert rule name.
.RuleIDuint64Alert rule ID.
.Queries[]QueryRule query definitions.
.RelateQueries[]RelateQueryRelated query definitions.
.CheckModestringCheck mode.
.DataLabelsmap[string]stringAlert labels.
.AppendLabelsmap[string]stringExtra labels configured on the rule.
.EnrichLabelsmap[string]stringLabels returned by the external enrichment endpoint. Enrichment runs before Description rendering, so templates can reference these labels.
.Valuesmap[string]float64Numeric values used by alert evaluation.
.Annotationsmap[string]stringRule annotations.
.Relatesmap[string][]*ResultRowRelated query result rows.
.Statusstringfiring or recovered.
.SeveritystringAlert severity.
.EvalTimeint64Evaluation timestamp in Unix seconds.
.DescriptionstringRendered description. This is set after template execution.
.DescriptionTypestringDescription type, for example text or markdown.
.Valuefloat64Main alert value.
.TitleRulestringTitle rule configured on the edge.
Query objects in .Queries have .Name, .Expr, .LabelFields, .ValueFields, and .Args. RelateQuery objects in .RelateQueries have .Name, .Expr, and .Args. Related query results are available through $relates. The map key is the related query name, such as R1.
Field or MethodTypeDescription
$row.Fieldsmap[string]interface{}Non-numeric or display fields returned by the related query.
$row.Valuesmap[string]float64Numeric fields returned by the related query.
$row.Field "name"interface{}Returns one field from $row.Fields.
$row.Valuefloat64Returns the first numeric value in $row.Values, or NaN if no value exists.
$row.Value "name"float64Returns one numeric value from $row.Values, or NaN if the key does not exist.
$row.StringstringReturns a debug-style string representation of the row.
Example:
{{- range $row := $relates.R1 }}
- msg: {{ $row.Field "_msg" }}
- count: {{ printf "%.0f" ($row.Value "count") }}
{{- end }}

Go Template Built-in Functions

These functions are provided by Go text/template.
FunctionDescriptionExample
andBoolean AND. Evaluation stops when the result is known.{{ if and $a $b }}yes{{ end }}
orBoolean OR. Evaluation stops when the result is known.{{ if or $a $b }}yes{{ end }}
notBoolean NOT.{{ if not $ok }}failed{{ end }}
eqEqual.{{ if eq $status "firing" }}...{{ end }}
neNot equal.{{ if ne $severity "Info" }}...{{ end }}
ltLess than.{{ if lt $value 10.0 }}...{{ end }}
leLess than or equal.{{ if le $value 10.0 }}...{{ end }}
gtGreater than.{{ if gt $value 10.0 }}...{{ end }}
geGreater than or equal.{{ if ge $value 10.0 }}...{{ end }}
indexReads an item from a map, slice, or array.{{ index $labels "instance" }}
sliceSlices a string, slice, or array.{{ slice "abcdef" 0 3 }}
lenReturns length.{{ len $relates.R1 }}
printfFormats text with fmt.Sprintf syntax.{{ printf "%.2f" $value }}
printConcatenates values with default formatting.{{ print $dsName ":" $status }}
printlnLike print, with a trailing newline.{{ println $dsName }}
callCalls a function value. Rarely needed in descriptions.{{ call .SomeFunc }}
htmlEscapes text for HTML.{{ html $text }}
jsEscapes text for JavaScript.{{ js $text }}
urlqueryEscapes text for URL query usage.{{ urlquery $text }}

monit-edge Custom Functions

These functions are registered by monit-edge without a prefix.
FunctionDescriptionExample
pathEscape textURL path escaping.{{ pathEscape "a/b c" }}
queryEscape textURL query escaping.{{ queryEscape "level=error msg" }}
getvalue values key [format]Reads a numeric value from a map[string]float64 and formats it. Default format is %.4f. Returns template_function_error: ... text if the key is invalid or missing.{{ getvalue $values "$A" "%.2f" }}
getfvalue values keyReads a numeric value from a map[string]float64. Returns NaN if the key is invalid or missing.{{ if gt (getfvalue $values "$A") 10.0 }}high{{ end }}
trunc count textAlias of truncRune. Truncates by Unicode characters, not bytes. Negative count keeps characters from the end.{{ trunc 10 $msg }}
truncRune count textTruncates by Unicode characters.{{ truncRune -8 "abcdef hello" }}
runeCount textCounts Unicode characters.{{ runeCount "hello" }}
args ...Builds a map with keys arg0, arg1, and so on.{{ args "a" 1 }}
reReplaceAll pattern repl textRegex replacement. Argument order is pattern, replacement, text. Invalid regex fails rendering.{{ reReplaceAll ".*id=([0-9]+).*" "$1" $msg }}
safeHtml textConverts text to html/template.HTML. Description templates are rendered with text/template, so this does not sanitize HTML or change escaping behavior. Avoid it for normal text or Markdown.{{ safeHtml "<b>OK</b>" }}
match pattern textRegex match. Equivalent to Go regexp.MatchString. Invalid regex fails rendering.{{ if match "Unknown column" $msg }}...{{ end }}
toUpper textConverts text to uppercase.{{ toUpper $severity }}
toLower textConverts text to lowercase.{{ toLower $status }}
stripPort hostPortRemoves port from host:port. If parsing fails, returns the original value.{{ stripPort "example.com:9100" }}
stripDomain hostPortRemoves domain suffix from hostname while preserving port. IP addresses are returned unchanged.{{ stripDomain "node01.prod.local:9100" }}
humanize valueFormats a number using SI units.{{ humanize 12345 }}
humanize1024 valueFormats a number using base-1024 units.{{ humanize1024 1048576 }}
humanizeDuration secondsFormats seconds as a readable duration.{{ humanizeDuration 3661 }}
humanizePercentage valueFormats a ratio as a percentage.{{ humanizePercentage 0.1234 }}
humanizeTimestamp secondsConverts a Unix timestamp in seconds to UTC time text.{{ humanizeTimestamp .EvalTime }}
toTime secondsConverts a Unix timestamp in seconds to a time.Time.{{ (toTime .EvalTime).Format "2006-01-02 15:04:05" }}
nanoTime value [tzOffset]Converts a Unix nanosecond timestamp to time.Time. Optional timezone offset is in hours.{{ (nanoTime $row.Fields.__time__ 8).Format "2006-01-02 15:04:05" }}
timeFormat value format [tzOffset]Formats a time.Time, *time.Time, RFC3339 string, or RFC3339Nano string. Optional timezone offset is in hours.{{ timeFormat "2026-01-06T11:48:12Z" "2006-01-02 15:04:05" 8 }}
parseDuration durationParses a duration string and returns seconds.{{ parseDuration "5m" }}
add a bNumeric addition.{{ add 1 2 }}
sub a bNumeric subtraction.{{ sub 10 3 }}
mul a bNumeric multiplication.{{ mul $value 100 }}
div a bNumeric division. Division by zero fails rendering.{{ div $value 1024 }}
nowCurrent time as time.Time.{{ now.Format "2006-01-02 15:04:05" }}
toString valueConverts a value to string using fmt.Sprint.{{ toString $row.Fields._msg }}

Sprig Functions

monit-edge registers safe Sprig functions with standard Sprig names and also with a sprig_ prefix. Sprig functions come from Masterminds/sprig. Check that repository for upstream function behavior. Common examples:
{{ contains "error" $msg }}
{{ regexMatch "Unknown column" $msg }}
{{ regexFind "Unknown column '[^']+'" $msg }}
Important regex note: regexFind and sprig_regexFind return the full matched substring. They do not return a capture group. To extract a capture group, use regexReplaceAll or sprig_regexReplaceAll:
{{- $msg := "Unknown column 'community_posts.comment_count' in 'field list'" }}
{{- regexReplaceAll ".*Unknown column '([^']+)'.*" $msg "$1" }}
The result is:
community_posts.comment_count

Common Sprig Functions

FunctionDescriptionExample
contains substr textChecks whether text contains substr.{{ if contains "Unknown column" $msg }}...{{ end }}
hasPrefix prefix textChecks prefix.{{ hasPrefix "prod-" $name }}
hasSuffix suffix textChecks suffix.{{ hasSuffix ".log" $file }}
regexMatch pattern textRegex match.{{ regexMatch "error|failed" $msg }}
regexFind pattern textReturns the first full regex match.{{ regexFind "trace_id=[a-z0-9]+" $msg }}
regexFindAll pattern text nReturns up to n full regex matches. Use -1 for all.{{ regexFindAll "id=[0-9]+" $msg -1 }}
regexReplaceAll pattern text replRegex replacement. Argument order is pattern, text, replacement.{{ regexReplaceAll ".*id=([0-9]+).*" $msg "$1" }}
trim textTrims leading and trailing whitespace.{{ trim $msg }}
lower textLowercase.{{ lower $severity }}
upper textUppercase.{{ upper $severity }}
default default valueUses a default value when value is empty.{{ default "unknown" (index $labels "instance") }}
toJson valueConverts a value to JSON.{{ toJson $labels }}
dict ...Creates a dictionary.{{ dict "name" $dsName "status" $status }}
list ...Creates a list.{{ list "a" "b" "c" }}
The same functions can also be called with sprig_ prefixes, such as sprig_contains and sprig_regexReplaceAll.

Disabled Sprig Functions

For predictable and safe alert rendering, monit-edge does not register Sprig functions that can read process environment variables, perform DNS lookup, generate random output, create credentials or certificates, encrypt or decrypt data, or intentionally fail rendering. The following Sprig functions are unavailable in both standard and sprig_ forms:
env / sprig_env
expandenv / sprig_expandenv
getHostByName / sprig_getHostByName
bcrypt / sprig_bcrypt
htpasswd / sprig_htpasswd
derivePassword / sprig_derivePassword
genPrivateKey / sprig_genPrivateKey
buildCustomCert / sprig_buildCustomCert
genCA / sprig_genCA
genCAWithKey / sprig_genCAWithKey
genSelfSignedCert / sprig_genSelfSignedCert
genSelfSignedCertWithKey / sprig_genSelfSignedCertWithKey
genSignedCert / sprig_genSignedCert
genSignedCertWithKey / sprig_genSignedCertWithKey
encryptAES / sprig_encryptAES
decryptAES / sprig_decryptAES
randBytes / sprig_randBytes
uuidv4 / sprig_uuidv4
randAlphaNum / sprig_randAlphaNum
randAlpha / sprig_randAlpha
randAscii / sprig_randAscii
randNumeric / sprig_randNumeric
randInt / sprig_randInt
shuffle / sprig_shuffle
fail / sprig_fail
If a template uses one of these functions, parsing fails with an error like function "env" not defined or function "sprig_env" not defined.

Complete Example: Extract MySQL Unknown Column

{{- if eq $status "firing" }}
In the last 5 minutes, database operations produced missing-field errors {{ $value | printf "%.0f" }} times.
{{- range $x := $relates.R1 }}
  {{- $msg := printf "%v" ($x.Field "_msg") }}
  {{- if contains "Unknown column" $msg }}
    {{- $field := regexReplaceAll ".*Unknown column '([^']+)'.*" $msg "$1" }}

- Missing field: {{ $field }}
- View logs: https://example.com/logs?query={{ queryEscape "Unknown column" }}
  {{- end }}
{{- end }}
{{- else }}
The database missing-field error has recovered.
{{- end }}

Troubleshooting

function "contains" not defined means the rule is running on an older monit-edge build that has not enabled standard Sprig names. Upgrade monit-edge, or use sprig_contains as a compatibility workaround if that build supports the prefixed form. function "env" not defined or function "sprig_env" not defined means the template used a disabled Sprig function. Remove it or replace it with deterministic template logic. regexFind or sprig_regexFind returning Unknown column 'x' instead of x is expected. Use regexReplaceAll or sprig_regexReplaceAll to extract capture groups.