Skip to content

Query Standard

Query Standard - CEL

The following CEL expressions are supported by the feed.
All expressions must evaluate to a boolean result.

Comparison Operators

level < 5
level <= 5
level > 1
level >= 1
name == "high_cpu"
description != "high_cpu"
level in [1, 2, 3, 4, 5]

String Functions

description.contains("cpu")
description.startsWith("high")
description.endsWith("cpu")

Logical Operators

level < 5 && name == "high_cpu"
level < 5 || name == "high_cpu"

Unary Operators

!enabled

Function Expressions

has(payload.level)

Combined Examples

level < 5 && name.startsWith("high_cpu")
payload.level in [1, 3, 5] || name == "high_cpu"
has(payload.level) && payload["level"] >= 1

Notes

  • Expressions must evaluate to a boolean value.
  • Field names must be valid CEL identifiers.
  • Keys containing special characters must be accessed using index syntax.
  • Arithmetic expressions are not supported.

Query Fields Recommendation

EMS supports query via all fields in the alert body, but there is difference of the query performance. To ensure good performance, we recommend using the following fields for querying:
- fingerprint
- name
- description
- timestamp
- service
- severity
- status
- source / providerType
- ticket_number
- PCC / pcc