Use Mustache Templates in Webhooks

Map webhook payload fields with Mustache templates.

Use Mustache templates to map webhook payload fields to alert fields in Harness AI SRE.

When to use Mustache in webhooks

Mustache templates are used for field mapping (populating alert field values) after a webhook is accepted. This is different from CEL expressions, which are used for filtering (deciding whether to create an alert).

Use Mustache for:

• Mapping webhook payload fields to alert fields

• Simple variable substitution

• Transforming webhook data into alert data

Use CEL for:

• Filtering which webhooks create alerts

• Conditional logic before alert creation

• Complex boolean expressions

Note: CEL is used for filtering (deciding whether to create an alert), while Mustache is used for mapping (populating alert field values). They serve different purposes in the webhook processing pipeline.

---

Field mapping with Mustache

After parsing your webhook payload in the visual builder, reference fields using Mustache templates:

Map basic fields

# Map webhook fields to alert fields <a href="#map-webhook-fields-to-alert-fields" id="map-webhook-fields-to-alert-fields"></a>
title: "{{webhook.alert_name}}"
description: "{{webhook.message}}"
severity: "{{webhook.severity}}"
service: "{{webhook.service}}"
environment: "{{webhook.environment}}"

Nested field access

# Access nested JSON fields <a href="#access-nested-json-fields" id="access-nested-json-fields"></a>
title: "{{webhook.alert.name}}"
service: "{{webhook.metadata.service}}"
region: "{{webhook.location.region}}"

Example: map a Datadog webhook

title: "{{webhook.title}}"
description: "{{webhook.body}}"
severity: "{{webhook.alert_type}}"
service: "{{webhook.tags[0]}}"
priority: "{{webhook.alert_priority}}"

Example: custom application webhook

title: "Alert from {{webhook.source}}"
description: "{{webhook.message}}"
severity: "{{webhook.level}}"
service: "{{webhook.app_name}}"
environment: "{{webhook.env}}"

---

Best practices

1. Use descriptive field names

# ✅ Clear mapping <a href="#clear-mapping" id="clear-mapping"></a>
title: "{{webhook.alert_title}}"
service: "{{webhook.service_name}}"

# ❌ Unclear mapping <a href="#unclear-mapping" id="unclear-mapping"></a>
title: "{{webhook.t}}"
service: "{{webhook.s}}"

2. Provide fallback values

If your webhook payload might not always include certain fields, test with sample payloads to ensure the mapping works correctly.

3. Map all required fields

Ensure you map all required alert fields from your webhook payload:

• title: Alert title.

• severity: Alert severity level.

• service: Affected service (if applicable).

4. Test your mappings

Validate each mapping before you rely on it in production:

1. Send a test webhook payload

2. Verify alert fields are populated correctly

3. Check for missing or incorrectly mapped values

4. Adjust mappings as needed

---

Combine Mustache with CEL filters

You can use CEL for filtering and Mustache for mapping in the same webhook:

Step 1: CEL filters the webhook

webhook.priority == "P1" && webhook.environment == "production"

Step 2: Mustache maps accepted webhooks to alerts

title: "{{webhook.alert_name}}"
description: "{{webhook.message}}"
severity: "{{webhook.severity}}"

---

Common patterns

Pattern 1: monitoring tool integration

# Generic monitoring tool mapping <a href="#generic-monitoring-tool-mapping" id="generic-monitoring-tool-mapping"></a>
title: "{{webhook.alert_title}}"
description: "{{webhook.alert_description}}"
severity: "{{webhook.alert_severity}}"
service: "{{webhook.service_name}}"
source: "{{webhook.source_system}}"

Pattern 2: track application errors

# Application error webhook <a href="#application-error-webhook" id="application-error-webhook"></a>
title: "{{webhook.error_type}} in {{webhook.app_name}}"
description: "{{webhook.error_message}}"
severity: "critical"
service: "{{webhook.app_name}}"
environment: "{{webhook.deployment_env}}"

Pattern 3: monitor infrastructure

# Infrastructure alert <a href="#infrastructure-alert" id="infrastructure-alert"></a>
title: "{{webhook.resource_type}} {{webhook.resource_name}} {{webhook.status}}"
description: "{{webhook.details}}"
severity: "{{webhook.severity_level}}"
service: "{{webhook.service_tag}}"
region: "{{webhook.region}}"

---

Complete payload and mapping examples

Example 1: generic alert format

Incoming webhook payload:

{
  "alert": {
    "name": "High CPU Usage",
    "severity": "critical",
    "message": "CPU usage above 90%",
    "timestamp": "2024-01-15T10:30:00Z"
  },
  "metadata": {
    "service": "payment-api",
    "environment": "production",
    "team": "platform"
  },
  "metrics": {
    "cpu_usage": 95.5,
    "memory_usage": 85.2
  }
}

Field mapping:

title: "{{webhook.alert.name}}"
description: "{{webhook.alert.message}}"
severity: "{{webhook.alert.severity}}"
service: "{{webhook.metadata.service}}"
environment: "{{webhook.metadata.environment}}"

Result: Creates an alert with title "High CPU Usage", description "CPU usage above 90%", severity "critical", service "payment-api", environment "production".

Example 2: monitoring system format

Incoming webhook payload:

{
  "monitor": {
    "id": "mon_12345",
    "status": "ALERT",
    "priority": "P1"
  },
  "resource": {
    "name": "payments-prod-api",
    "type": "kubernetes_pod",
    "namespace": "production"
  },
  "data": {
    "threshold": 90,
    "current_value": 95.5,
    "duration": "5m"
  }
}

Field mapping:

title: "{{webhook.resource.type}} {{webhook.resource.name}} alert"
description: "Monitor {{webhook.monitor.id}}: {{webhook.resource.type}} exceeded threshold"
severity: "{{webhook.monitor.priority}}"
service: "{{webhook.resource.name}}"
environment: "{{webhook.resource.namespace}}"

Result: Creates an alert with title "kubernetes_pod payments-prod-api alert", service "payments-prod-api", environment "production", severity "P1".

Example 3: custom application format

Incoming webhook payload:

{
  "application": "order-service",
  "alert_type": "business_logic",
  "details": {
    "error": "Database connection timeout",
    "impact": "Order processing delayed",
    "affected_regions": ["us-west-1", "us-east-1"]
  },
  "context": {
    "datacenter": "aws-us-west",
    "component": "order-processor"
  }
}

Field mapping:

title: "{{webhook.alert_type}} error in {{webhook.application}}"
description: "{{webhook.details.error}} - Impact: {{webhook.details.impact}}"
severity: "critical"
service: "{{webhook.application}}"
environment: "{{webhook.context.datacenter}}"

Result: Creates an alert with title "business_logic error in order-service", description "Database connection timeout - Impact: Order processing delayed", service "order-service".

---

Next steps

• Go to Use CEL in Webhooks for webhook filtering with CEL expressions

• Go to Ingest Alerts to learn about webhook setup

• Go to Configure Ingest Alerts for native integration options

Need Help? Contact our support team by email at [e-mail] or visit the Harness Documentation for additional resources and troubleshooting guides.