Grafana Alerts: How to add alert created time (startsAt) into alert annotation?

Hello,
Is it possible to add alert created time (a.k.a. startsAt) into alert annotations? I looked at Templating labels and annotations but I couldn’t find anything on matching/calling alert created/startsAt time.

Explanation:
To clarify, I am adding picture of alert created time (red marked) from Grafana console:

Alert created time is saved as startsAt JSON object in alert message:

startsAt JSON object
{
  "receiver": "Webhooksite",
  "status": "firing",
  "alerts": [
    {
      "status": "firing",
      "labels": {
        "AlertID": "CPU_Cores:monitoringserver",
        "Contact": "webhook",
        "Severity": "Critical",
        "alertname": "CPU_Cores",
        "cpu": "cpu0",
        "grafana_folder": "Dev",
        "host": "monitoringserver"
      },
      "annotations": {
        "DashboardURL": "http://192.168.101.131:3000/d/fkwAvHo4k/linux-hosts?orgId=1&var-datasource=test&var-Server=monitoringserver&viewPanel=2&from=now-12h&to=now",
        "description": "On server monitoringserver cpu core cpu0 is above 91.0%.",
        "summary": "CPU Core alert"
      },
      "startsAt": "2023-01-21T12:58:00+01:00",
      "endsAt": "0001-01-01T00:00:00Z",
      "generatorURL": "http://grafana.staged-by-discourse.com/alerting/grafana/gc34VtF4z/view?orgId=1",
      "fingerprint": "1d42325aaab24ba9",
      "silenceURL": "http://grafana.staged-by-discourse.com/alerting/silence/new?alertmanager=grafana&matcher=AlertID%3DCPU_Cores%3Amonitoringserver&matcher=Contact%3Dwebhook&matcher=Severity%3DCritical&matcher=alertname%3DCPU_Cores&matcher=cpu%3Dcpu0&matcher=grafana_folder%3DDev&matcher=host%3Dmonitoringserver",
      "dashboardURL": "http://grafana.staged-by-discourse.com/d/WnRPNXuMz?orgId=1",
      "panelURL": "http://grafana.staged-by-discourse.com/d/WnRPNXuMz?orgId=1&viewPanel=3",
      "values": {
        "alert": 1,
        "reduced": 91.21044553335274,
        "result": 91
      },
      "valueString": "[ var='reduced' labels={cpu=cpu0, host=monitoringserver} value=91.21044553335274 ], [ var='result' labels={cpu=cpu0, host=monitoringserver} value=91 ], [ var='alert' labels={cpu=cpu0, host=monitoringserver} value=1 ]"
    }
  ],
  "groupLabels": {
    "AlertID": "CPU_Cores:monitoringserver",
    "Contact": "webhook",
    "Severity": "Critical",
    "__alert_rule_uid__": "gc34VtF4z",
    "alertname": "CPU_Cores",
    "cpu": "cpu0",
    "grafana_folder": "Dev",
    "host": "monitoringserver"
  },
  "commonLabels": {
    "AlertID": "CPU_Cores:monitoringserver",
    "Contact": "webhook",
    "Severity": "Critical",
    "alertname": "CPU_Cores",
    "cpu": "cpu0",
    "grafana_folder": "Dev",
    "host": "monitoringserver"
  },
  "commonAnnotations": {
    "DashboardURL": "http://192.168.101.131:3000/d/fkwAvHo4k/linux-hosts?orgId=1&var-datasource=test&var-Server=monitoringserver&viewPanel=2&from=now-12h&to=now",
    "description": "On server monitoringserver cpu core cpu0 is above 91.0%.",
    "summary": "CPU Core alert"
  },
  "externalURL": "http://grafana.staged-by-discourse.com/",
  "version": "1",
  "groupKey": "{}/{Contact=\"webhook\"}:{AlertID=\"CPU_Cores:monitoringserver\", Contact=\"webhook\", Severity=\"Critical\", __alert_rule_uid__=\"gc34VtF4z\", alertname=\"CPU_Cores\", cpu=\"cpu0\", grafana_folder=\"Dev\", host=\"monitoringserver\"}",
  "truncatedAlerts": 0,
  "orgId": 1,
  "title": "[FIRING:1] CPU_Cores CPU_Cores:monitoringserver webhook Critical gc34VtF4z cpu0 Dev monitoringserver ",
  "state": "alerting",
  "message": "**Firing**\n\nValue: alert=1, reduced=91.21044553335274result=91\nLabels:\n - alertname = CPU_Cores\n - AlertID = CPU_Cores:monitoringserver\n - Contact = webhook\n - Severity = Critical\n - cpu = cpu0\n - grafana_folder = Dev\n - host = monitoringserver\nAnnotations:\n - DashboardURL = http://192.168.101.131:3000/d/fkwAvHo4k/linux-hosts?orgId=1&var-datasource=test&var-Server=monitoringserver&viewPanel=2&from=now-12h&to=now\n - description = On server monitoringserver cpu core cpu0 is above 91.0%.\n - summary = CPU Core alert\nSource: http://grafana.staged-by-discourse.com/alerting/grafana/gc34VtF4z/view?orgId=1\nSilence: http://grafana.staged-by-discourse.com/alerting/silence/new?alertmanager=grafana&matcher=AlertID%3DCPU_Cores%3Amonitoringserver&matcher=Contact%3Dwebhook&matcher=Severity%3DCritical&matcher=alertname%3DCPU_Cores&matcher=cpu%3Dcpu0&matcher=grafana_folder%3DDev&matcher=host%3Dmonitoringserver\nDashboard: http://grafana.staged-by-discourse.com/d/WnRPNXuMz?orgId=1\nPanel: http://grafana.staged-by-discourse.com/d/WnRPNXuMz?orgId=1&viewPanel=3\n"
}

What I would like to do
I would like to use variable {{ $startsAt }} inside Annotation field “DashboardURL” so that when user receives alert message and clicks on DashboardURL link it opens specific dashboard in time range when alert happened (e.g. &from={{ $startsAt }}-30m&to={{ $startsAt }}+30m). I am looking for something like next code (doesn’t work):

http://192.168.101.131:3000/d/fkwAvHo4k/linux-hosts?orgId=1&var-datasource=test&var-Server={{ $values.result.Labels.host }}&viewPanel=2&from={{ $startsAt }}-30m&to={{ $startsAt }}+30m

This is how I would like that dashboard opens:

Is it possible to add alert created time (startsAt) into annotations? What is the proper syntax to call that variable?

Best regards,
ldrascic

4 Likes

same question.