Templates & Import
Alert rule templates
Clicking Create New Alert Rule opens a template picker so you don't start from a blank query.
Recipes are complete, ready-to-tune rules organised by category:
| Category | Examples |
|---|---|
| Kubernetes | High pod CPU (sustained CPU above threshold, per pod) |
| Logs | Log errors (error count), Log error % (errors as a percentage of all logs, per workload) |
| Traces | API 5xx errors (HTTP server errors per workload), API latency increase (p95 vs an hour ago), API success rate (non-5xx percentage per workload) |
Recipes come pre-configured with the right filters and grouping — for example, the trace templates scope to HTTP traffic and group by workload so each service alerts independently — and land you in the editor with everything filled in, ready to adjust the threshold and pick channels.
Alert type starters pre-configure just the condition shape — Threshold, Ratio, Change, New Value — and leave the query to you.
Placeholders in names and descriptions
Rule names and descriptions support {{label}} placeholders that resolve per instance in notifications and on the alert pages — e.g. High CPU on {{pod}} in {{namespace}} becomes High CPU on checkout-6f7b… in production. Any label on the alert works: group-by values, static rule labels, and built-ins like severity. A placeholder that doesn't match a label is left as-is, so double-check spelling against your group-by fields.
Importing and exporting rules
- Import — the Import button on the Alert Rules tab accepts one rule or an array of rules as JSON. Every rule is validated upfront (query fields, group-by columns, filters) with a dry-run summary showing what passes and what fails — nothing is created until you confirm.
- Export — every rule's detail page has an Export action that downloads it as re-importable JSON (live state stripped), useful for promoting rules between environments or checking them into git.
- Migrating from Datadog? See Datadog Alert Migration for converting Datadog monitors into KubeSense alert rules in bulk.
Notification message templates
The Alert Templates tab customises what notifications look like, per channel type — overriding the built-in message layout for Slack, Teams, Email, Google Chat, and Webhook deliveries.
- Create a template for a channel type, edit the message fields it exposes (title, body, etc.), and use the same
{{label}}placeholders plus alert fields (value, threshold, status) in the content. - Preview renders the template with sample alert data before you save.
- Clone an existing template to iterate on a variant.
Without a custom template, channels use the built-in layout described in Integrations — including the per-alert View in Kubesense deep link to the exact firing instance.