Menu
Grafana Cloud

Labels and annotations

Labels and annotations contain information about an alert. Labels are used to differentiate an alert from all other alerts, while annotations are used to add additional information to an existing alert.

Labels

Labels contain information that identifies an alert. An example of a label might be server=server1 or team=backend. Each alert can have more than one label, and the complete set of labels for an alert is called its label set. It is this label set that identifies the alert.

For example, an alert might have the label set {alertname="High CPU usage",server="server1"} while another alert might have the label set {alertname="High CPU usage",server="server2"}. These are two separate alerts because although their alertname labels are the same, their server labels are different.

Labels are a fundamental component of alerting:

  • The complete set of labels for an alert is what uniquely identifies an alert within Grafana alerts.
  • The alerting UI shows labels for every alert instance generated during evaluation of that rule.
  • Contact points can access labels to send notification messages that contain specific alert information.
  • The Alertmanager uses labels to match alerts for silences and alert groups in notification policies.

Note that two alert rules cannot have the same labels. If two alert rules have the same labels such as foo=bar,bar=baz and foo=bar,bar=baz then one of the alerts will be discarded.

How label matching works

Use labels and label matchers to link alert rules to notification policies and silences. This allows for a flexible way to manage your alert instances, specify which policy should handle them, and which alerts to silence.

A label matchers consists of 3 distinct parts, the label, the value and the operator.

  • The Label field is the name of the label to match. It must exactly match the label name.

  • The Value field matches against the corresponding value for the specified Label name. How it matches depends on the Operator value.

  • The Operator field is the operator to match against the label value. The available operators are:

    OperatorDescription
    =Select labels that are exactly equal to the value.
    !=Select labels that are not equal to the value.
    =~Select labels that regex-match the value.
    !~Select labels that do not regex-match the value.

If you are using multiple label matchers, they are combined using the AND logical operator. This means that all matchers must match in order to link a rule to a policy.

Label types

An alert’s label set can contain three types of labels:

  • Labels from the datasource,
  • Custom labels specified in the alert rule,
  • A series of reserved labels, such as alertname or grafana_folder.

Custom Labels

Custom labels are additional labels configured manually in the alert rule.

Ensure the label set for an alert does not have two or more labels with the same name. If a custom label has the same name as a label from the datasource then it will replace that label. However, should a custom label have the same name as a reserved label then the custom label will be omitted from the alert.

Reserved labels

Reserved labels can be used in the same way as manually configured custom labels. The current list of available reserved labels are:

LabelDescription
alert_nameThe name of the alert rule.
grafana_folderTitle of the folder containing the alert.

Labels prefixed with grafana_ are reserved by Grafana for special use. To stop Grafana Alerting from adding a reserved label, you can disable it via the disabled_labels option in unified_alerting.reserved_labels configuration.

Annotations

Both labels and annotations have the same structure: a set of named values; however their intended uses are different. The purpose of annotations is to add additional information to existing alerts.

There are a number of suggested annotations in Grafana such as description, summary, runbook_url, dashboardUId and panelId. Like custom labels, annotations must have a name, and their value can contain a combination of text and template code that is evaluated when an alert is fired.