> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sre/3.0/ai-sre-for-administrators/set-up-alert-management/webhooks/use-mustache-webhooks.md).

# Use Mustache Templates in Webhooks

Use Mustache templates to map webhook payload fields to alert fields in Harness AI SRE.

### When to use Mustache in webhooks <a href="#when-to-use-mustache-in-webhooks" id="when-to-use-mustache-in-webhooks"></a>

Mustache templates are used for **field mapping** (populating alert field values) after a webhook is accepted. This is different from CEL expressions, which are used for **filtering** (deciding whether to create an alert).

**Use Mustache for:**

* Mapping webhook payload fields to alert fields
* Simple variable substitution
* Transforming webhook data into alert data

**Use CEL for:**

* Filtering which webhooks create alerts
* Conditional logic before alert creation
* Complex boolean expressions

**Note**: CEL is used for **filtering** (deciding whether to create an alert), while Mustache is used for **mapping** (populating alert field values). They serve different purposes in the webhook processing pipeline.

***

### Field mapping with Mustache <a href="#field-mapping-with-mustache" id="field-mapping-with-mustache"></a>

After parsing your webhook payload in the visual builder, reference fields using Mustache templates:

#### Map basic fields <a href="#map-basic-fields" id="map-basic-fields"></a>

```yaml
# Map webhook fields to alert fields <a href="#map-webhook-fields-to-alert-fields" id="map-webhook-fields-to-alert-fields"></a>
title: "{{webhook.alert_name}}"
description: "{{webhook.message}}"
severity: "{{webhook.severity}}"
service: "{{webhook.service}}"
environment: "{{webhook.environment}}"
```

#### Nested field access <a href="#nested-field-access" id="nested-field-access"></a>

```yaml
# Access nested JSON fields <a href="#access-nested-json-fields" id="access-nested-json-fields"></a>
title: "{{webhook.alert.name}}"
service: "{{webhook.metadata.service}}"
region: "{{webhook.location.region}}"
```

#### Example: map a Datadog webhook <a href="#example-map-a-datadog-webhook" id="example-map-a-datadog-webhook"></a>

```yaml
title: "{{webhook.title}}"
description: "{{webhook.body}}"
severity: "{{webhook.alert_type}}"
service: "{{webhook.tags[0]}}"
priority: "{{webhook.alert_priority}}"
```

#### Example: custom application webhook <a href="#example-custom-application-webhook" id="example-custom-application-webhook"></a>

```yaml
title: "Alert from {{webhook.source}}"
description: "{{webhook.message}}"
severity: "{{webhook.level}}"
service: "{{webhook.app_name}}"
environment: "{{webhook.env}}"
```

***

### Best practices <a href="#best-practices" id="best-practices"></a>

#### 1. Use descriptive field names <a href="#id-1-use-descriptive-field-names" id="id-1-use-descriptive-field-names"></a>

```yaml
# ✅ Clear mapping <a href="#clear-mapping" id="clear-mapping"></a>
title: "{{webhook.alert_title}}"
service: "{{webhook.service_name}}"

# ❌ Unclear mapping <a href="#unclear-mapping" id="unclear-mapping"></a>
title: "{{webhook.t}}"
service: "{{webhook.s}}"
```

#### 2. Provide fallback values <a href="#id-2-provide-fallback-values" id="id-2-provide-fallback-values"></a>

If your webhook payload might not always include certain fields, test with sample payloads to ensure the mapping works correctly.

#### 3. Map all required fields <a href="#id-3-map-all-required-fields" id="id-3-map-all-required-fields"></a>

Ensure you map all required alert fields from your webhook payload:

* **title:** Alert title.
* **severity:** Alert severity level.
* **service:** Affected service (if applicable).

#### 4. Test your mappings <a href="#id-4-test-your-mappings" id="id-4-test-your-mappings"></a>

Validate each mapping before you rely on it in production:

1. Send a test webhook payload
2. Verify alert fields are populated correctly
3. Check for missing or incorrectly mapped values
4. Adjust mappings as needed

***

### Combine Mustache with CEL filters <a href="#combine-mustache-with-cel-filters" id="combine-mustache-with-cel-filters"></a>

You can use CEL for filtering and Mustache for mapping in the same webhook:

**Step 1: CEL filters the webhook**

```cel
webhook.priority == "P1" && webhook.environment == "production"
```

**Step 2: Mustache maps accepted webhooks to alerts**

```yaml
title: "{{webhook.alert_name}}"
description: "{{webhook.message}}"
severity: "{{webhook.severity}}"
```

***

### Common patterns <a href="#common-patterns" id="common-patterns"></a>

#### Pattern 1: monitoring tool integration <a href="#pattern-1-monitoring-tool-integration" id="pattern-1-monitoring-tool-integration"></a>

```yaml
# Generic monitoring tool mapping <a href="#generic-monitoring-tool-mapping" id="generic-monitoring-tool-mapping"></a>
title: "{{webhook.alert_title}}"
description: "{{webhook.alert_description}}"
severity: "{{webhook.alert_severity}}"
service: "{{webhook.service_name}}"
source: "{{webhook.source_system}}"
```

#### Pattern 2: track application errors <a href="#pattern-2-track-application-errors" id="pattern-2-track-application-errors"></a>

```yaml
# Application error webhook <a href="#application-error-webhook" id="application-error-webhook"></a>
title: "{{webhook.error_type}} in {{webhook.app_name}}"
description: "{{webhook.error_message}}"
severity: "critical"
service: "{{webhook.app_name}}"
environment: "{{webhook.deployment_env}}"
```

#### Pattern 3: monitor infrastructure <a href="#pattern-3-monitor-infrastructure" id="pattern-3-monitor-infrastructure"></a>

```yaml
# Infrastructure alert <a href="#infrastructure-alert" id="infrastructure-alert"></a>
title: "{{webhook.resource_type}} {{webhook.resource_name}} {{webhook.status}}"
description: "{{webhook.details}}"
severity: "{{webhook.severity_level}}"
service: "{{webhook.service_tag}}"
region: "{{webhook.region}}"
```

***

### Complete payload and mapping examples <a href="#complete-payload-and-mapping-examples" id="complete-payload-and-mapping-examples"></a>

#### Example 1: generic alert format <a href="#example-1-generic-alert-format" id="example-1-generic-alert-format"></a>

**Incoming webhook payload:**

```json
{
  "alert": {
    "name": "High CPU Usage",
    "severity": "critical",
    "message": "CPU usage above 90%",
    "timestamp": "2024-01-15T10:30:00Z"
  },
  "metadata": {
    "service": "payment-api",
    "environment": "production",
    "team": "platform"
  },
  "metrics": {
    "cpu_usage": 95.5,
    "memory_usage": 85.2
  }
}
```

**Field mapping:**

```yaml
title: "{{webhook.alert.name}}"
description: "{{webhook.alert.message}}"
severity: "{{webhook.alert.severity}}"
service: "{{webhook.metadata.service}}"
environment: "{{webhook.metadata.environment}}"
```

**Result:** Creates an alert with title "High CPU Usage", description "CPU usage above 90%", severity "critical", service "payment-api", environment "production".

#### Example 2: monitoring system format <a href="#example-2-monitoring-system-format" id="example-2-monitoring-system-format"></a>

**Incoming webhook payload:**

```json
{
  "monitor": {
    "id": "mon_12345",
    "status": "ALERT",
    "priority": "P1"
  },
  "resource": {
    "name": "payments-prod-api",
    "type": "kubernetes_pod",
    "namespace": "production"
  },
  "data": {
    "threshold": 90,
    "current_value": 95.5,
    "duration": "5m"
  }
}
```

**Field mapping:**

```yaml
title: "{{webhook.resource.type}} {{webhook.resource.name}} alert"
description: "Monitor {{webhook.monitor.id}}: {{webhook.resource.type}} exceeded threshold"
severity: "{{webhook.monitor.priority}}"
service: "{{webhook.resource.name}}"
environment: "{{webhook.resource.namespace}}"
```

**Result:** Creates an alert with title "kubernetes\_pod payments-prod-api alert", service "payments-prod-api", environment "production", severity "P1".

#### Example 3: custom application format <a href="#example-3-custom-application-format" id="example-3-custom-application-format"></a>

**Incoming webhook payload:**

```json
{
  "application": "order-service",
  "alert_type": "business_logic",
  "details": {
    "error": "Database connection timeout",
    "impact": "Order processing delayed",
    "affected_regions": ["us-west-1", "us-east-1"]
  },
  "context": {
    "datacenter": "aws-us-west",
    "component": "order-processor"
  }
}
```

**Field mapping:**

```yaml
title: "{{webhook.alert_type}} error in {{webhook.application}}"
description: "{{webhook.details.error}} - Impact: {{webhook.details.impact}}"
severity: "critical"
service: "{{webhook.application}}"
environment: "{{webhook.context.datacenter}}"
```

**Result:** Creates an alert with title "business\_logic error in order-service", description "Database connection timeout - Impact: Order processing delayed", service "order-service".

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* Go to [Use CEL in Webhooks](/ai-sre/ai-sre-for-administrators/set-up-alert-management/webhooks/use-cel-webhooks.md) for webhook filtering with CEL expressions
* Go to [Ingest Alerts](/ai-sre/ai-sre-for-administrators/set-up-alert-management/webhooks/overview.md) to learn about webhook setup
* Go to [Configure Ingest Alerts](/ai-sre/ai-sre-for-administrators/set-up-alert-management/webhooks/templates/overview.md) for native integration options