> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/ai-sre/3.0/ai-sre-for-administrators/set-up-alert-management/webhooks/use-mustache-webhooks.md).

# Use Mustache Templates in Webhooks

Learn how to use Mustache templates for webhook field mapping in Harness AI SRE.

Use Mustache templates to map webhook payload fields to alert fields in Harness AI SRE.

### When to use Mustache in webhooks <a href="#when-to-use-mustache-in-webhooks" id="when-to-use-mustache-in-webhooks"></a>

Mustache templates are used for **field mapping** (populating alert field values) after a webhook is accepted. This is different from CEL expressions, which are used for **filtering** (deciding whether to create an alert).

**Use Mustache for:**

* Mapping webhook payload fields to alert fields
* Simple variable substitution
* Transforming webhook data into alert data

**Use CEL for:**

* Filtering which webhooks create alerts
* Conditional logic before alert creation
* Complex boolean expressions

**Note**: CEL is used for **filtering** (deciding whether to create an alert), while Mustache is used for **mapping** (populating alert field values). They serve different purposes in the webhook processing pipeline.

***

### Field mapping with Mustache <a href="#field-mapping-with-mustache" id="field-mapping-with-mustache"></a>

After parsing your webhook payload in the visual builder, reference fields using Mustache templates:

#### Map basic fields <a href="#map-basic-fields" id="map-basic-fields"></a>

```yaml
# Map webhook fields to alert fields
title: "{{webhook.alert_name}}"
description: "{{webhook.message}}"
severity: "{{webhook.severity}}"
service: "{{webhook.service}}"
environment: "{{webhook.environment}}"
```

#### Nested field access <a href="#nested-field-access" id="nested-field-access"></a>

```yaml
# Access nested JSON fields
title: "{{webhook.alert.name}}"
service: "{{webhook.metadata.service}}"
region: "{{webhook.location.region}}"
```

#### Example: map a Datadog webhook <a href="#example-map-a-datadog-webhook" id="example-map-a-datadog-webhook"></a>

```yaml
title: "{{webhook.title}}"
description: "{{webhook.body}}"
severity: "{{webhook.alert_type}}"
service: "{{webhook.tags[0]}}"
priority: "{{webhook.alert_priority}}"
```

#### Example: custom application webhook <a href="#example-custom-application-webhook" id="example-custom-application-webhook"></a>

```yaml
title: "Alert from {{webhook.source}}"
description: "{{webhook.message}}"
severity: "{{webhook.level}}"
service: "{{webhook.app_name}}"
environment: "{{webhook.env}}"
```

***

### Best practices <a href="#best-practices" id="best-practices"></a>

#### 1. Use descriptive field names <a href="#id-1-use-descriptive-field-names" id="id-1-use-descriptive-field-names"></a>

```yaml
# ✅ Clear mapping
title: "{{webhook.alert_title}}"
service: "{{webhook.service_name}}"

# ❌ Unclear mapping
title: "{{webhook.t}}"
service: "{{webhook.s}}"
```

#### 2. Provide fallback values <a href="#id-2-provide-fallback-values" id="id-2-provide-fallback-values"></a>

If your webhook payload might not always include certain fields, test with sample payloads to ensure the mapping works correctly.

#### 3. Map all required fields <a href="#id-3-map-all-required-fields" id="id-3-map-all-required-fields"></a>

Ensure you map all required alert fields from your webhook payload:

* **title:** Alert title.
* **severity:** Alert severity level.
* **service:** Affected service (if applicable).

#### 4. Test your mappings <a href="#id-4-test-your-mappings" id="id-4-test-your-mappings"></a>

Validate each mapping before you rely on it in production:

1. Send a test webhook payload
2. Verify alert fields are populated correctly
3. Check for missing or incorrectly mapped values
4. Adjust mappings as needed

***

### Combine Mustache with CEL filters <a href="#combine-mustache-with-cel-filters" id="combine-mustache-with-cel-filters"></a>

You can use CEL for filtering and Mustache for mapping in the same webhook:

**Step 1: CEL filters the webhook**

```cel
webhook.priority == "P1" && webhook.environment == "production"
```

**Step 2: Mustache maps accepted webhooks to alerts**

```yaml
title: "{{webhook.alert_name}}"
description: "{{webhook.message}}"
severity: "{{webhook.severity}}"
```

***

### Common patterns <a href="#common-patterns" id="common-patterns"></a>

#### Pattern 1: monitoring tool integration <a href="#pattern-1-monitoring-tool-integration" id="pattern-1-monitoring-tool-integration"></a>

```yaml
# Generic monitoring tool mapping
title: "{{webhook.alert_title}}"
description: "{{webhook.alert_description}}"
severity: "{{webhook.alert_severity}}"
service: "{{webhook.service_name}}"
source: "{{webhook.source_system}}"
```

#### Pattern 2: track application errors <a href="#pattern-2-track-application-errors" id="pattern-2-track-application-errors"></a>

```yaml
# Application error webhook
title: "{{webhook.error_type}} in {{webhook.app_name}}"
description: "{{webhook.error_message}}"
severity: "critical"
service: "{{webhook.app_name}}"
environment: "{{webhook.deployment_env}}"
```

#### Pattern 3: monitor infrastructure <a href="#pattern-3-monitor-infrastructure" id="pattern-3-monitor-infrastructure"></a>

```yaml
# Infrastructure alert
title: "{{webhook.resource_type}} {{webhook.resource_name}} {{webhook.status}}"
description: "{{webhook.details}}"
severity: "{{webhook.severity_level}}"
service: "{{webhook.service_tag}}"
region: "{{webhook.region}}"
```

***

### Complete payload and mapping examples <a href="#complete-payload-and-mapping-examples" id="complete-payload-and-mapping-examples"></a>

#### Example 1: generic alert format <a href="#example-1-generic-alert-format" id="example-1-generic-alert-format"></a>

**Incoming webhook payload:**

```json
{
  "alert": {
    "name": "High CPU Usage",
    "severity": "critical",
    "message": "CPU usage above 90%",
    "timestamp": "2024-01-15T10:30:00Z"
  },
  "metadata": {
    "service": "payment-api",
    "environment": "production",
    "team": "platform"
  },
  "metrics": {
    "cpu_usage": 95.5,
    "memory_usage": 85.2
  }
}
```

**Field mapping:**

```yaml
title: "{{webhook.alert.name}}"
description: "{{webhook.alert.message}}"
severity: "{{webhook.alert.severity}}"
service: "{{webhook.metadata.service}}"
environment: "{{webhook.metadata.environment}}"
```

**Result:** Creates an alert with title "High CPU Usage", description "CPU usage above 90%", severity "critical", service "payment-api", environment "production".

#### Example 2: monitoring system format <a href="#example-2-monitoring-system-format" id="example-2-monitoring-system-format"></a>

**Incoming webhook payload:**

```json
{
  "monitor": {
    "id": "mon_12345",
    "status": "ALERT",
    "priority": "P1"
  },
  "resource": {
    "name": "payments-prod-api",
    "type": "kubernetes_pod",
    "namespace": "production"
  },
  "data": {
    "threshold": 90,
    "current_value": 95.5,
    "duration": "5m"
  }
}
```

**Field mapping:**

```yaml
title: "{{webhook.resource.type}} {{webhook.resource.name}} alert"
description: "Monitor {{webhook.monitor.id}}: {{webhook.resource.type}} exceeded threshold"
severity: "{{webhook.monitor.priority}}"
service: "{{webhook.resource.name}}"
environment: "{{webhook.resource.namespace}}"
```

**Result:** Creates an alert with title "kubernetes\_pod payments-prod-api alert", service "payments-prod-api", environment "production", severity "P1".

#### Example 3: custom application format <a href="#example-3-custom-application-format" id="example-3-custom-application-format"></a>

**Incoming webhook payload:**

```json
{
  "application": "order-service",
  "alert_type": "business_logic",
  "details": {
    "error": "Database connection timeout",
    "impact": "Order processing delayed",
    "affected_regions": ["us-west-1", "us-east-1"]
  },
  "context": {
    "datacenter": "aws-us-west",
    "component": "order-processor"
  }
}
```

**Field mapping:**

```yaml
title: "{{webhook.alert_type}} error in {{webhook.application}}"
description: "{{webhook.details.error}} - Impact: {{webhook.details.impact}}"
severity: "critical"
service: "{{webhook.application}}"
environment: "{{webhook.context.datacenter}}"
```

**Result:** Creates an alert with title "business\_logic error in order-service", description "Database connection timeout - Impact: Order processing delayed", service "order-service".

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* Go to [Use CEL in Webhooks](/ai-sre/3.0/ai-sre-for-administrators/set-up-alert-management/webhooks/use-cel-webhooks.md) for webhook filtering with CEL expressions
* Go to [Ingest Alerts](/ai-sre/3.0/ai-sre-for-administrators/set-up-alert-management/webhooks/overview.md) to learn about webhook setup
* Go to [Configure Ingest Alerts](/ai-sre/ai-sre-for-administrators/set-up-alert-management/webhooks/templates/overview.md) for native integration options

{% @harness-feedback/feedback %}