Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fnotification-center%2Fdynamic-templating.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fuser-guides%2Fnotification-center%2Fdynamic-templating.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

# Dynamic templating

Dynamic templating lets you customize notification content and routing using Tera expressions. Use it to make messages, routing rules, and connector configurations respond to alert or case data in real time.

## Where to use dynamic templating[​](#where-to-use-dynamic-templating "Direct link to Where to use dynamic templating")

Tera expressions work in:

* **Connectors**: dynamically set URLs, headers, channels, or service keys
* **Presets**: customize message content for alerts and cases
* **Routing rules**: create conditions that determine where notifications are sent

## What dynamic templating does[​](#what-dynamic-templating-does "Direct link to What dynamic templating does")

Dynamic templating supports:

* Inserting alert or case values directly into message templates
* Applying conditional logic (`if`, `elif`, `else`)
* Formatting timestamps, numbers, and text
* Routing notifications based on metadata such as priority, team, or service

## Global context available[​](#global-context-available "Direct link to Global context available")

All templates have access to a built-in `_context` variable containing metadata about the notification source.

| Variable                                   | Description                                                                           |
| ------------------------------------------ | ------------------------------------------------------------------------------------- |
| `_context`                                 | Contains metadata about the context of the notification source type.                  |
| `_context.entityType`                      | The notification source type (`alerts`, `cases`).                                     |
| `_context.entitySubType`                   | The entity subtype (for example, `metricThresholdTriggered`).                         |
| `_context.entityLabels`                    | Notification source type labels associated with the context (e.g., `host`, `region`). |
| `_context.system`                          | Information about the system, including its ID and name.                              |
| `_context.system.id`                       | The system's unique identifier.                                                       |
| `_context.system.name`                     | Your Coralogix team or system name (e.g., `acme-prod`).                               |
| `_context.trigger`                         | The trigger that initiated the notification source type.                              |
| `_context.trigger.type`                    | Trigger type (`manual`, `automatic`).                                                 |
| `_context.trigger.automaticTrigger`        | Automatic trigger details (if applicable).                                            |
| `_context.trigger.manualTrigger`           | Manual trigger details (e.g., user email).                                            |
| `_context.trigger.manualTrigger.userEmail` | The email address of the user who manually triggered the notification source type.    |

## Label data shapes: alerts vs. Cases[​](#label-data-shapes-alerts-vs-cases "Direct link to Label data shapes: alerts vs. Cases")

Label data has different shapes depending on its source. The same key can be a single value or an array of values, so use the right read form for each. If you read an array-shaped label without indexing into it, the template renders the array literal, including the surrounding square brackets. The bracketed output then propagates into whatever the template feeds, for example Slack channel names, HTTPS payload fields, ServiceNow ticket fields, or email subject lines.

| Variable                    | Source               | Shape              | How to read                                  |
| --------------------------- | -------------------- | ------------------ | -------------------------------------------- |
| `alertDef.entityLabels`     | Alert definition     | `{ key: value }`   | `{{ alertDef.entityLabels["Service"] }}`     |
| `alert.groups[N].keyValues` | Alert group          | `{ key: value }`   | `{{ alert.groups[0].keyValues["Service"] }}` |
| `_context.entityLabels`     | Notification context | `{ key: value[] }` | `{{ _context.entityLabels["Service"][0] }}`  |
| `case.labels`               | Case                 | `{ key: value[] }` | `{{ case.labels["Service"][0] }}`            |

For alerts, `_context.entityLabels` arrays always contain a single value. For Cases, the array can contain multiple values; use `[0]` to read the first one. For `case.labels` and `_context.entityLabels`, always index into the array. For `alertDef.entityLabels` and `alert.groups`, read the value directly.

To confirm the shape for a specific notification before writing a template, see [Inspect context](#inspect-context).

## Common use cases[​](#common-use-cases "Direct link to Common use cases")

### Insert dynamic values[​](#insert-dynamic-values "Direct link to Insert dynamic values")

```
{{ alert.highestPriority }} - {{ alertDef.name }}
```

### Conditional output[​](#conditional-output "Direct link to Conditional output")

```
{% if alert.highestPriority == "P1" %}

#critical-alerts

{% elif alert.highestPriority == "P3" %}

#warn-alerts

{% else %}

#general

{% endif %}
```

### Format dates[​](#format-dates "Direct link to Format dates")

```
{{ alert.timestamp | date(format="%Y-%m-%d %H:%M") }}
```

### Use default values[​](#use-default-values "Direct link to Use default values")

```
{{ alertDef.entityLabels.team | default(value="no team assigned") }}
```

## Inspect context[​](#inspect-context "Direct link to Inspect context")

To view the entire context object during configuration, use:

```
{{ get_context() | json_encode(pretty = true) }}
```

Note

* Wrap dynamic expressions in `{{ }}` or `{% %}`.
* Use the `default` filter to handle missing values.
* Keep templates simple; avoid unnecessary complexity.
* Test templates with example data before saving.

## Examples[​](#examples "Direct link to Examples")

* Conditional alert handling based on name
* Logs threshold alert description
* Grouping by service

```
{% if alertDef.name == "RDS Instance Low CPU" %}

affected db: {{ alert.groups[0].keyValues.DBInstanceIdentifier }}

credit balance is below: {{ i.condition.threshold }}

owning team: {{ alert.groups[0].keyValues.Team }}



{% elif alertDef.name == "OOM killed pod" %}

pod: {{ alert.groups[0].keyValues.k8s_pod_name }}

container: {{ alert.groups[0].keyValues.k8s_container_name }}



{% else %}

{{ alertDef.name }} is triggering

{% endif %}
```

```
{{ alert.timestamp | date(format="%Y-%m-%d %H:%M") }}



We've detected that the query result has dropped below the threshold for the following values of {{ alertDef.groupByKeys }}:



Priority / Values / Threshold / Start Time / End Time

{% for i in alert.groups %}

{{ i.priority }} / {{ i.keyValues | json_escape }} / {{ i.details.logsThreshold.fromTimestamp | date(format="%Y-%m-%d %H:%M") }} / {{ i.details.logsThreshold.toTimestamp }}

{% endfor %}



Alert Query:

{{ alertDef.typeDefinition.logsThreshold.luceneQuery }}



Alert Condition Rules:

Condition type - {{ alertDef.typeDefinition.logsThreshold.rules[0].condition.conditionType }}

Condition rules -

{% for i in alertDef.typeDefinition.logsThreshold.rules %}

Threshold: {{ i.condition.threshold }}, timeframe: {{ i.condition.timeWindow.logsTimeWindowSpecificValue }}.

{% endfor %}



@jane.doe  

@here
```

```
{

  "alert_url": "https://teamname-prod.app.eu2.coralogix.com/#/alerts/{{ alert.id }}",

  "service": "{{ alert.groups[0].keyValues.service_name }}",

  "priority": "{{ alert.highestPriority }}",

  "timestamp": "{{ alert.timestamp | date(format=\"%Y-%m-%d %H:%M\") }}",

  "status": "{{ alert.status }}"

}
```

## Next steps[​](#next-steps "Direct link to Next steps")

Explore operators, filters, and tests for building Tera expressions in [Tera syntax quick reference](https://coralogix.com/docs/user-guides/notification-center/dynamic-templating/tera-syntax.md).