Receive Alert Notifications via Webhook

Getting started

The Webhook channel sends alert notifications as JSON to any HTTP endpoint you configure. Use it to forward alerts to custom services, automation, or tools Last9 does not integrate with natively.

For several popular platforms, Last9 auto-detects the webhook URL and formats the payload for that platform instead of sending the generic payload below. See the dedicated guides for Microsoft Teams, Flock, Google Chat, Telegram, Jira, and Zenduty.

Setting up a notification channel in Last9

In Notification Channels, click Add Channel and choose Webhook.
Enter the webhook URL of your endpoint.
Save the channel. Assign it to an Alert Group to start receiving notifications.

Notification Payload

Last9 sends one JSON POST request per alert event. The generic webhook payload uses the following fields.

Field	Type	Description
routing_key	string	The full generic webhook URL generated in Last9. This is used to send alerts to your configured endpoint
event_action	string	The type of event. Can be `trigger` or `resolve`
dedup_key	string	Deduplication key for correlating triggers and resolves. The maximum permitted length of this property is 255 characters
payload.summary	string	A brief text summary of the event, used to generate the summaries/titles of any associated alerts
payload.source	string	The unique location of the affected system, preferably a hostname or FQDN
payload.severity	string	The perceived severity of the status the event is describing with respect to the affected system. This can be `critical`, `error`, `warning` or `info`
payload.timestamp	timestamp	The time at which the emitting tool detected or generated the event
payload.component	string	Component of the source machine that is responsible for the event, for example `mysql` or `eth0`
payload.group	string	Logical grouping of components of a service, for example `app-stack`
payload.class	string	The class/type of the event, for example `ping failure` or `cpu load`
payload.custom_details	object	Additional details about the event and affected system. The keys depend on the alert type, see Example payloads
payload.metric_alert_annotations	object	Alert group alerts only. Annotations set on the alert rule, for example `description` and `runbook`. Omitted when the rule has none
payload.metric_alert_labelsets	object	Alert group alerts only. Labels of the time series that fired, for example `{"service": "checkout"}`. Omitted when one notification covers several series
payload.metric_alert_group_labels	object	Alert group alerts only. Labels the alert rule groups its series by, for example `{"span_name": "POST /pay"}`
payload.metric_alert_timing	object	Alert group alerts only. `start` and `end` of the alert
client	string	Always `Last9 Dashboard`
client_url	string	Link to the alert in Last9
images	array of objects	List of images to include
links	array of objects	List of links to include

Log alert fields

Alerts from log scheduled searches also include these top-level fields.

Field	Type	Description
log_lines	array of objects	Sample of the log lines that matched the search. Each line has `timestamp`, `severity`, and `body`
log_preview_error	string	Why the log lines could not be fetched, if they could not. `null` otherwise
scheduled_search_condition	string	The alert condition of the search, for example `query_found`
scheduled_search_log_count	number	The evaluated alert value, truncated to an integer. For count-based searches, the number of log lines that matched in the evaluated window; for aggregate searches such as `avg(response_time)`, the aggregate result (625.75 is sent as `625`), not a count
view_logs_url	string	Link to the matching logs in Last9

Example payloads

An alert group alert that fires:

{
  "payload": {
    "summary": "Alert Rule checkout-service — checkout latency · 1 time series affected",
    "timestamp": "2026-05-09T07:09:00.000+0000",
    "severity": "critical",
    "component": null,
    "source": "3c437a7a-c8ce-47ca-a52a-3d6938549417:48aacd57-7782-4136-b5bd-2c7582fca12e:breach-static_threshold",
    "group": "3c437a7a-c8ce-47ca-a52a-3d6938549417:48aacd57-7782-4136-b5bd-2c7582fca12e:breach-static_threshold",
    "class": "Static Threshold",
    "custom_details": {
      "What happened": "p95 latency above 500 ms",
      "Severity": "Breach",
      "Duration": "88 out of 88 minutes",
      "Condition": "p95 latency > 500",
      "Metric": "p95 latency",
      "Impact": "42.8% degradation",
      "Series affected": "1 time series affected"
    },
    "metric_alert_annotations": {
      "description": "p95 latency above 500 ms",
      "runbook": "https://wiki.example.com/runbooks/checkout-latency"
    },
    "metric_alert_timing": {
      "start": "2026-05-09T05:41:00.000+0000",
      "end": "2026-05-09T07:09:00.000+0000"
    }
  },
  "routing_key": "https://example.com/webhook",
  "dedup_key": "3c437a7a-c8ce-47ca-a52a-3d6938549417:48aacd57-7782-4136-b5bd-2c7582fca12e:breach-static_threshold",
  "images": [],
  "links": [],
  "event_action": "trigger",
  "client": "Last9 Dashboard",
  "client_url": "https://app.last9.io/v2/organizations/<org>/compass/entities/<entity-id>/health?..."
}

A log alert that fires:

{
  "payload": {
    "summary": "Scheduled Search Triggered - checkout errors",
    "timestamp": "2026-05-28T07:53:39.000+0000",
    "severity": "critical",
    "component": null,
    "source": "3c437a7a-c8ce-47ca-a52a-3d6938549417:48aacd57-7782-4136-b5bd-2c7582fca12e:breach-static_threshold",
    "group": "3c437a7a-c8ce-47ca-a52a-3d6938549417:48aacd57-7782-4136-b5bd-2c7582fca12e:breach-static_threshold",
    "class": "Static Threshold",
    "custom_details": {
      "severity": "Breach",
      "client_url": "https://app.last9.io/v2/organizations/<org>/compass/entities/<entity-id>/health?...",
      "rule_name": "checkout errors",
      "telemetry": "logs",
      "evaluation_frequency": "Every 5 Minutes",
      "alert_condition": "When query matches",
      "matched_log_count": "12 matching log entries"
    }
  },
  "routing_key": "https://example.com/webhook",
  "dedup_key": "3c437a7a-c8ce-47ca-a52a-3d6938549417:48aacd57-7782-4136-b5bd-2c7582fca12e:breach-static_threshold",
  "images": [],
  "links": [],
  "event_action": "trigger",
  "client": "Last9 Dashboard",
  "client_url": "https://app.last9.io/v2/organizations/<org>/compass/entities/<entity-id>/health?...",
  "log_lines": [
    {
      "timestamp": "2026-05-28T07:25:13Z",
      "severity": "ERROR",
      "body": "payment declined"
    }
  ],
  "log_preview_error": null,
  "scheduled_search_condition": "query_found",
  "view_logs_url": "https://app.last9.io/v2/organizations/<org>/compass/entities/<entity-id>/health?...",
  "scheduled_search_log_count": 12
}

When the alert resolves, the payload carries only the fields needed to match the earlier trigger:

{
  "routing_key": "https://example.com/webhook",
  "dedup_key": "3c437a7a-c8ce-47ca-a52a-3d6938549417:48aacd57-7782-4136-b5bd-2c7582fca12e:breach-static_threshold",
  "event_action": "resolve"
}

Troubleshooting

Please get in touch with us on Discord or Email if you have any questions.