Alert Data Fields

Last modified on July 26, 2024

This topic describes data fields in alerts sent to PagerDuty, Splunk and via HTTP POST and the default field names in JSON alerts.

All field types are string unless otherwise noted.

Availability Alert Fields

Field Name Description Sample Values
custid Your AlertSite customer ID, as seen on the  > Settings > Account screen in AlertSite UXM or in Account > Manage Account in AlertSite 1.0. C12345
company Your company name, as seen on the  > Settings > Account screen in AlertSite UXM or in Account > Manage Account in AlertSite 1.0. SmartBear
device_id

Can be one of the following values:

 121352
device_name

Monitor name. For real-browser (DéjàClick) monitors configured with ContentViews, the ContentView name is included in parentheses after the monitor name.

Note: Users can change the monitor names, so do not rely on them remaining the same. Use device_id as an identification property instead.

Private node connectivity alerts have device_name = PrivateNode Monitors.

 Home Page
device_type Monitor type (see below). Web Server
device_typecode Monitor type code (see below). w
errcount Number of consecutive errors. “Clear” alerts have errcount = 0. 3
http_status HTTP status of the monitor or transaction step. HTTP/1.1 200 OK
HTTP/1.1 503 Service Unavailable
location The name of AlertSite monitoring location that found the error. Fort Lauderdale, FL
location_num The ID of AlertSite monitoring location (see Monitoring Locations for the ID list). 10
source Always AlertSite. AlertSite
status AlertSite status code. 0 means a successful test. 5
status_text Description of the AlertSite status code. Validation failed
timestamp The date and time when the site was last checked, in the format YYYY-MM-DD hh:mm:ss. The timestamps use the time zone specified in your AlertSite account settings. 2015-05-18 13:33:06
transaction

Possible values:

  • 1 – for DéjàClick, SoapUI, and Selenium monitors.

  • 0 – for all other monitor types.

 0
Additional fields for DéjàClick, SoapUI and Selenium monitors (both JSON and form-formatted alerts)
step_name The name of the transaction step that failed. Customer Login
step_num The number of the transaction step. 3
Additional fields for ServerAgent alerts (form-formatted alerts only). Tab-delimited values, if more than one.
key_names Name of the server measurement. DISK_INFO->DRIVE_C_USAGE
key_thresholds Your specified threshold limit. 95
key_values Actual value. 98
Additional fields in JSON alerts
notify_type

Possible values:

  • error – An availability error.

  • clear – “All clear” (the error condition stopped).

  • test – A test alert.

 error
rotated_locations Only included if the monitor uses rotated locations or the monitoring mode SLA (MultiPOP) or Round Robin. This is an array of all locations used by the monitor, with the current status at each location.  
rotated_locations[index].location The AlertSite location name. Fort Lauderdale, FL
rotated_locations[].status The monitor status at this location. 0 means no errors. 5
rotated_locations[].status_text The description of the AlertSite status code. Validation failed
url The monitored URL in web URL and API endpoint monitors. https://example.com

Below are possible values of the device_type and device_typecode fields:

device_typecode device_type Description
"" (empty string) Server/Device Ping Ping monitor
a Web Site API API endpoint monitor
b Secure Web Site API API endpoint monitor for https://
e E-mail (SMTP) Server SMTP server monitor
f FTP Server FTP monitor
F Secure FTP Server FTPS (FTP over SSL) monitor
i E-mail (IMAP) Server IMAP server monitor
l Selenium Script Selenium monitor
m DejaClick Device Real-browser or mobile web monitor
n Name Server DNS monitor
o Bitbar Monitor BitBar monitor
p E-mail (POP) Server POP server monitor
r Roundtrip E-mail (POP/SMTP) Round-trip email monitor
s Secure Web Server Web URL monitor for https://
t Simple TCP Connect TCP monitor
u SoapUI Device SoapUI monitor
w Web Server Web URL monitor
y Monitored Server ServerAgent or private node connectivity alert
z Security Device Security scan

Performance Alert Fields

Field Name Description Sample Values
custid Your AlertSite customer ID, as seen on the  > Settings > Account screen in AlertSite UXM or in Account > Manage Account in AlertSite 1.0. C12345
company Your company name, as seen on the  > Settings > Account screen in AlertSite UXM or in Account > Manage Account in AlertSite 1.0. SmartBear
device_id

Monitor ID.

ContentView ID – for real-browser monitors with ContentViews, if the performance condition occurred in that ContentView.

 121352
device_name

Monitor name. Real-browser (DéjàClick) monitor names may include ContentView names if the performance condition occurred in that ContentView.

Note: Users can change the monitor names, so do not rely on them remaining the same. Use device_id as an identification property instead.

 Home Page
Home Page - ContentView: 3rd-party
timestamp The date and time when the site was last checked, in the format YYYY-MM-DD hh:mm:ss. The timestamps use the time zone specified in your AlertSite account settings. 2015-05-18 13:33:06
notify_type

Performance alert type:

  • perf_error – error
  • perf_warning – warning
  • perf_clear – “all clear” (the error or warning condition stopped)
 perf_error
status

Possible values:

  • 20 – error
  • 10 – warning
 20
locations An array of all monitoring locations used by the monitor. See below for location data fields.  
perf_count Integer. The total number of monitoring locations used by the monitor. 2
Location fields
perf_location The location name. Fort Lauderdale, FL
perf_location_num The location ID. See Monitoring Locations for possible values. 10
perf_actual Current average response time at this location, in seconds. 4.706
perf_threshold Response time threshold, in seconds, that is specified in the monitor settings. If the location’s perf_status = 20, this is the error threshold; otherwise it is the warning threshold. 2.500
perf_status

The performance condition that this location observes. Possible values:

  • 20 – error
  • 10 – warning
  • 0 – no error (response time is within the threshold)

This value is not necessarily the same as the alert type (status).

 20

Additional Fields for PagerDuty and Splunk Alerts

Field Name Description Sample Values
service_key

For PagerDuty – AlertSite service key in PagerDuty.

For Splunk – the Splunk server URL.

  
event_type

Possible values:

  • trigger – availability or performance error
  • resolve – “all clear” (the error condition stopped)
  • nop – test alert
 trigger
incident_key Reserved.  
description The monitor name and (in availability alerts) the location that discovered an error.

Home Page at location Portland, Oregon

Already fixed the issue with Home Page at location Portland, Oregon
client Always AlertSite Monitoring Service. AlertSite Monitoring Service
client_url AlertSite login URL. https://www.alertsite.com/login

See Also

Alerts
JSON Alerts
Performance Alerts

Highlight search results