--- name: cloud-logs-event-payload title: Event payload that is sent from IBM Cloud Logs to IBM Cloud Event Notifications description: Successful events that are generated by IBM Cloud Logs contain various fields that help you to identify the source and details of an event. last-updated: 2025-10-17 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/cloud-logs?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Event payload that is sent from IBM Cloud Logs to IBM Cloud Event Notifications {: #event-payload} Successful events that are generated by IBM Cloud Logs contain various fields that help you to identify the source and details of an event. Events that are generated by the IBM Cloud Logs service contain only metadata properties, such as names or identifiers of resources. Sensitive data, for example API keys or passwords, are not included in generated events. {: note} The properties that are sent to Event Notifications vary depending on the event type and subtype. For example, if a `StandardMoreThanAlertEvent:AlertTriggered` event takes place in an instance, IBM Cloud Logs sends a notification payload to Event Notifications that is similar to the following example. ## Payload {: #event-payload-1} ```json { "data": { "alert_definition": { "alert_type": "StandardMoreThanAlertEvent", "condition": { "MoreThan": { "condition_threshold": 1, "condition_timeframe": 1 } }, "description": "", "id": "", "meta_labels": { "env": "prod" }, "name": "", "query_statement": "_exists_:level", "severity": "ERROR", "versioned_id": "", }, "latest_event_timestamp": 0000000000000, "links": { "edit_alert": "https://dashboard.eu-gb.logs.cloud.ibm.com//#/alerts/", "view_alert": "https://dashboard.eu-gb.logs.cloud.ibm.com//#/insights?id=c9fe7539-e901-4745-b3ad-29ca0ae987a0" }, "log_example": {"msg":"Test Log"}, "log_example_truncated": true, "meta_labels_truncated": false, "priority": "", "status": "triggered" }, "datacontenttype": "application/json", "ibmendefaultlong": "Triggered: 2024-01-01T00:00:00Z", "ibmendefaultshort": "ERROR - new_groupBy", "ibmenseverity": "info", "ibmensourceid": "crn:v1:bluemix:public:logs::a/:::", "id": "997355d5-4542-47fd-9868-84cf5df71e1b_c9fe7539-e901-4745-b3ad-29ca0ae987a0", "notification_id": "923873c0-2b42-4d4c-a9a0-c69339b16717", "source": "crn:v1:bluemix:public:logs::a/:::", "specversion": "1.0", "time": "2024-01-01T00:00:00.000000Z", "type": "com.ibm.cloud.logs.:" } ``` {: codeblock} Review following table for more information about event notification properties. | Property | Description | | ---- | ---- | | `alert_definition` | - `alert_type`: The [type of alert](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-cl-events-for-en&format=markdown#cl-events-for-en-types) that triggered a notification. \n - `condition`: Alerts configuration when alerts can be triggered. \n - `description`: The description of the alert. \n - `id`: The unique identifier of the triggered alert. This is the same ID that can be used in API calls. \n - `name`: The name of the given alert. \n - `query_statement`: The Lucene search query of the given alert. \n - `severity`: The [severity](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-event-severities&format=markdown) level of the given alert. \n - `versioned_id`: The versioned ID of the triggered alert. This is the ID generated when the alert definition is updated. | | `latest_event_timestamp` | The date and time the event was generated. | | `links` | - `edit_alert`: Link to the page to modify configurations of the alert. \n - `view_alert`: Link to the page to check alert details. | | `priority` | The [priority](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-priorities&format=markdown) of the condition which triggered the alert. | | `status` | The status of the given alert. | | `ibmendefaultshort` | The name of the given alert. | | `ibmendefaultlong` | The combination of the action, triggerered or resolved, and the name of the alert. | | `ibmenseverity` | The severity of the alert. | | `ibmensourceid` | The Cloud Resource Name (CRN) that uniquely identifies your IBM Cloud Logs service instance. | | `id` | The identifier provided by IBM Cloud Logs that would identify the event in IBM Cloud Logs | | `notification_id` | The identifier created by Event Notifications. | | `source` | The Cloud Resource Name (CRN) that uniquely identifies your IBM Cloud Logs service instance. | | `time` | The time when an alert notification is triggerered. | | `type` | The combination of the [type of event](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-cl-events-for-en&format=markdown#cl-events-for-en-types) that triggered a notification and the[subtype](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-cl-events-for-en&format=markdown#cl-events-for-en-subtypes) that corresponds with the [type of event](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-cl-events-for-en&format=markdown#cl-events-for-en-types) that triggered a notification. | {: caption="Properties in an event notification payload" caption-side="bottom"} ## Data Size {: #event-payload-2} In an event, the following lengths apply: | Field Name | Maximum number of characters | |------------|--------------------| | data.log_example | 1000 | | data.alert_definition.meta_labels | 400 | | data.alert_definition.name | 100 | | data.alert_definition.description | 100 | | data.alert_definition.query_statement | 100| {: caption="Data size" caption-side="bottom"} Each field in the payload has a specific size. If any field exceeds its maximum number of characters, the payload will be truncated. Consider the following information: - If a string field exceeds its maximum number of characters, it will be truncated, and an ellipsis (...) will be appended to indicate that the content has been cut off. - Meta labels will be included up to the limit. - Meta label keys and values will count toward the limit. - If the log_example field exceeds its maximum number of characters, it will be converted to a string containing part of the log data followed by an ellipsis (...) to indicate truncation. - The following additional fields are added to the data to indicate when a sample or labels are truncated: `log_example_truncated`: This field will be added to the payload to indicate that an example log entry was truncated. If `log_example_truncated` is `true`, truncated JSON is sent to IBM Cloud Event Notifications as stringified JSON. {: note} `meta_labels_truncated`: This field will be added to indicate that metadata labels were truncated. ## Special characters in custom template values {: #event-payload-custom} If you are using a value in a custom template that includes a period (`.`) in the name, you need to enclose the value in square brackets (`[ ]`). For example, if the value you want to include in your notification is `kubernetes.cluster_name`, you need to include the value similar to this: ```text "CloudLogs_Shared_Summary": "{{data.log_example.[kubernetes.cluster_name]}}" ``` {: codeblock}