Manage your alerts on Grafana Labs

Customize notifications

Sun, 08 Mar 2026 02:10:29 +0000

Customize notifications

Customize your notifications with notifications templates.

You can use notification templates to change the title, message, and format of the message in your notifications.

Notification templates are not tied to specific contact point integrations, such as email or Slack. However, you can choose to create separate notification templates for different contact point integrations.

You can use notification templates to:

Customize the subject of an email or the title of a message.
Add, change or remove text in notifications. For example, to select or omit certain labels, annotations and links.
Format text in bold and italic, and add or remove line breaks.

You cannot use notification templates to:

Add HTML and CSS to email notifications to change their visual appearance.
Change the design of notifications in instant messaging services such as Slack and Microsoft Teams. For example, to add or remove custom blocks with Slack Block Kit or adaptive cards with Microsoft Teams.
Choose the number and size of images, or where in the notification images are shown.
Customize the data in webhooks, including the fields or structure of the JSON data or send the data in other formats such as XML.
Add or remove HTTP headers in webhooks other than those in the contact point configuration.

Using Go’s templating language

Learn how to write the content of your notification templates in Go’s templating language.

Create reusable notification templates for your contact points.

Use notification templates

Use notification templates to send notifications to your contact points.

Reference

Data that is available when writing templates.

Use images in notifications

Sun, 08 Mar 2026 02:10:29 +0000

Use images in notifications

Images in notifications helps recipients of alert notifications better understand why an alert has fired or resolved by including a screenshot of the panel associated with the alert.

Note
This feature is not supported in Mimir or Loki, or when Grafana is configured to send alerts to other Alertmanagers such as the Prometheus Alertmanager

When an alert is fired or resolved Grafana takes a screenshot of the panel associated with the alert. This is determined via the Dashboard UID and Panel ID annotations of the rule. Grafana cannot take a screenshot for alerts that are not associated with a panel.

Grafana takes at most two screenshots for each alert: once when the alert fires and again when the alert is resolved. Screenshots are not re-taken over the lifetime of the alert, instead you should open the panel in Grafana to follow the data in real time. In addition, depending on how alerts are grouped in your notification policies, Grafana might send a notification with many screenshots of the same panel. This happens because Grafana does not know how your alerts are grouped at the time a screenshot is taken, and so acts conservatively by taking a screenshot for every alert.

Once a screenshot has been taken Grafana can either upload it to a cloud storage service such as Amazon S3, Azure Blob Storage or Google Cloud Storage; upload the screenshot to it’s internal web server; or upload it to the service that is receiving the notification, such as Slack. Which option you should choose depends on how your Grafana is managed and which integrations you use. More information on this can be found in Requirements.

Refer to the table at the end of this page for a list of contact points and their support for images in notifications.

Requirements

To use images in notifications, Grafana must be set up to use image rendering. You can either install the image rendering plugin or run it as a remote rendering service.
When a screenshot is taken it is saved to the data folder, even if Grafana is configured to upload screenshots to a cloud storage service. Grafana must have write-access to this folder otherwise screenshots cannot be saved to disk and an error will be logged for each failed screenshot attempt.
You should use a cloud storage service unless sending alerts to Discord, Email, Pushover, Slack or Telegram. These integrations support either embedding screenshots in the email or attaching screenshots to the notification, while other integrations must link screenshots uploaded to a cloud storage bucket. If a cloud storage service has been configured then integrations that support both will link screenshots from the cloud storage bucket instead of embedding or attaching screenshots to the notification.
If uploading screenshots to a cloud storage service such as Amazon S3, Azure Blob Storage or Google Cloud Storage; and accessing screenshots in the bucket requires authentication, logging into a VPN or corporate network; then image previews might not work in all instant messaging and communication platforms as some services rewrite URLs to use their CDN. If this happens we recommend using integrations which support uploading images or disabling images in notifications altogether.
When uploading screenshots to a cloud storage service Grafana uses a random 20 character (30 characters for Azure Blob Storage) filename for each image. This makes URLs hard to guess but not impossible.
Grafana does not delete screenshots from cloud storage. We recommend configuring a retention policy with your cloud storage service to delete screenshots older than 1 month.
If Grafana is configured to upload screenshots to its internal web server, and accessing Grafana requires logging into a VPN or corporate network; image previews might not work in all instant messaging and communication platforms as some services rewrite URLs to use their CDN. If this happens we recommend using integrations which support uploading images or disabling images in notifications altogether.
Grafana does not delete screenshots uploaded to its internal web server. To delete screenshots from static_root_path/images/attachments after a certain amount of time we recommend setting up a CRON job.

Configuration

Note
Grafana Cloud users can request this feature by opening a support ticket in the Cloud Portal.

Having installed either the image rendering plugin, or set up Grafana to use a remote rendering service, set capture in [unified_alerting.screenshots] to true:

# Enable screenshots in notifications. You must have either installed the Grafana image rendering
# plugin, or set up Grafana to use a remote rendering service.
# For more information on configuration options, refer to [rendering].
capture = false

If screenshots should be uploaded to cloud storage then upload_external_image_storage should also be set to true:

# Uploads screenshots to the local Grafana server or remote storage such as Azure, S3 and GCS. Please
# see [external_image_storage] for further configuration options. If this option is false, screenshots
# will be persisted to disk for up to temp_data_lifetime.
upload_external_image_storage = false

Please see [external_image_storage] for instructions on how to configure cloud storage. Grafana will not start if upload_external_image_storage is true and [external_image_storage] contains missing or invalid configuration.

If Grafana is acting as its own cloud storage then [upload_external_image_storage] should be set to true and the local provider should be set in [external_image_storage].

Restart Grafana for the changes to take effect.

Advanced configuration

We recommended that max_concurrent_screenshots is less than or equal to concurrent_render_request_limit. The default value for both max_concurrent_screenshots and concurrent_render_request_limit is 5:

# The maximum number of screenshots that can be taken at the same time. This option is different from
# concurrent_render_request_limit as max_concurrent_screenshots sets the number of concurrent screenshots
# that can be taken at the same time for all firing alerts where as concurrent_render_request_limit sets
# the total number of concurrent screenshots across all Grafana services.
max_concurrent_screenshots = 5

Supported contact points

Grafana supports a wide range of contact points with varied support for images in notifications. The table below shows the list of all contact points supported in Grafana and their support for uploading screenshots to the receiving service and referencing screenshots that have been uploaded to a cloud storage service.

Name	Upload from disk	Reference from cloud storage
DingDing	No	No
Discord	Yes (Maximum of 10 per notification)	Yes (Maximum of 10 per notification)
Email	Yes (Embedded in the email)	Yes
Google Hangouts Chat	No	Yes
Kafka	No	No
Line	No	No
Microsoft Teams	No	Yes
Opsgenie	No	Yes
Pagerduty	No	Yes
Prometheus Alertmanager	No	No
Pushover	Yes (Maximum of 1 per notification)	No
Sensu Go	No	No
Slack	Yes (when using Bot tokens, maximum of 5 per notification)	Yes (when using webhooks, maximum of 1 per notification)
Telegram	Yes	No
Threema	No	No
VictorOps	No	No
Webhook	No	Yes

Limitations

This feature is not supported in Mimir or Loki, or when Grafana is configured to send alerts to other Alertmanagers such as the Prometheus Alertmanager.
A number of contact points support at most one image per notification. In this case, just the first image is either uploaded to the receiving service or referenced from cloud storage per notification.
When multiple alerts are sent in a single notification a screenshot might be included for each alert. The order the images are shown is random.
If uploading screenshots to a cloud storage service such as Amazon S3, Azure Blob Storage or Google Cloud Storage; and accessing screenshots in the bucket requires authentication, logging into a VPN or corporate network; image previews might not work in all instant messaging and communication platforms as some services rewrite URLs to use their CDN.

Troubleshooting

If Grafana has been set up to send images in notifications, however notifications are still being received without them, follow the troubleshooting steps below:

Check that images in notifications has been set up as per the instructions.
Enable debug logging in Grafana and look for logs with the logger ngalert.image.
If the alert is not associated with a dashboard there will be logs for Cannot take screenshot for alert rule as it is not associated with a dashboard.
If the alert is associated with a dashboard, but no panel in the dashboard, there will be logs for Cannot take screenshot for alert rule as it is not associated with a panel.
If images cannot be taken because of mis-configuration or an issue with image rendering there will be logs for Failed to take an image including the Dashboard UID, Panel ID, and the error message.
Check that the contact point supports images in notifications and whether it supports uploading images to the receiving service or referencing images that have been uploaded to a cloud storage service.

Metrics

Grafana provides the following metrics to observe the performance and failure rate of images in notifications. For example, if a screenshot could not be taken within the expected time (10 seconds) then the counter grafana_screenshot_failures_total is updated.

grafana_alerting_image_cache_hits_total
grafana_alerting_image_cache_misses_total
grafana_screenshot_duration_seconds
grafana_screenshot_failures_total
grafana_screenshot_successes_total
grafana_screenshot_upload_failures_total
grafana_screenshot_upload_successes_total

Manage silences

Sun, 08 Mar 2026 02:10:29 +0000

Manage silences

Silences stop notifications from getting created and last for only a specified window of time.

Note that inhibition rules are not supported in the Grafana Alertmanager.

Add silences

To add a silence, complete the following steps.

In the left-side menu, click Alerts & IRM and then Alerting.
Click Silences.
From the Alertmanager dropdown, select an external Alertmanager to create and manage silences for the external data source. Otherwise, keep the default option of Grafana.
Click Create silence to open the Create silence page.
In Silence start and end, select the start and end date to indicate when the silence should go into effect and expire.
Optionally, in Duration, specify how long the silence is enforced. This automatically updates the end time in the Silence start and end field.
In the Label and Value fields, enter one or more Matching Labels. Matchers determine which rules the silence will apply to.
In Comment, add details about the silence.
Click Submit.

Edit silences

To edit a silence, complete the following steps.

In the left-side menu, click Alerts & IRM and then Alerting.
Click Silences to view the list of existing silences.
Find the silence you want to edit, then click Edit (pen icon).
Make the desired changes, then click Submit to save your changes.

Create a URL to link to a silence form

When linking to a silence form, provide the default matching labels and comment via matcher and comment query parameters. The matcher parameter should be in the following format [label][operator][value] where the operator parameter can be one of the following: = (equals, not regex), != (not equals, not regex), =~ (equals, regex), !~ (not equals, regex). The URL can contain many query parameters with the key matcher. For example, to link to silence form with matching labels severity=critical & cluster!~europe-.* and comment Silence critical EU alerts, create a URL https://mygrafana/alerting/silence/new?matcher=severity%3Dcritical&matcher=cluster!~europe-*&comment=Silence%20critical%20EU%20alert.

To link to a new silence page for an external Alertmanager, add a alertmanager query parameter with the Alertmanager data source name.

Remove silences

To remove a silence, complete the following steps.

In the left-side menu, click Alerts & IRM and then Alerting.
Click Silences to view the list of existing silences.
Select the silence you want to end, then click Unsilence.

Note: You cannot remove a silence manually. Silences that have ended are retained and listed for five days.

Useful links

Aggregation operators

View and filter alert rules

Sun, 08 Mar 2026 02:10:29 +0000

View and filter alert rules

The Alerting page lists all existing alert rules. By default, rules are grouped by types of data sources. The Grafana section lists all Grafana managed rules. Alert rules for Prometheus compatible data sources are also listed here. You can view alert rules for Prometheus compatible data sources but you cannot edit them.

The Mimir/Cortex/Loki rules section lists all rules for Mimir, Cortex, or Loki data sources. Cloud alert rules are also listed in this section.

When managing large volumes of alerts, you can use extended alert rule search capabilities to filter on folders, evaluation groups, and rules. Additionally, you can filter alert rules by their properties like labels, state, type, and health.

View and filter alert rules

View alert rules

To view alerting details:

In the Grafana menu, click the Alerting (bell) icon to open the Alerting page. By default, the List view displays.
In View as, toggle between Grouped or State views by clicking the relevant option. See Grouped view and State view for more information.
Expand the rule row to view the rule labels, annotations, data sources the rule queries, and a list of alert instances resulting from this rule.

From the Alert list page, you can also make copies of alert rules to help you reuse existing alert rules.

Export alert rules

Click Export to create and tune an alert rule in the UI, then export to YAML or JSON, and use in the provisioning API or files. You can also export an entire rule group to review or use.

Note: This is supported in both the UI and provisioning API.

View query definitions for provisioned alerts

View read-only query definitions for provisioned alerts. Check quickly if your alert rule queries are correct, without diving into your “as-code” repository for rule definitions.

Grouped view

Grouped view shows Grafana alert rules grouped by folder and Loki or Prometheus alert rules grouped by namespace + group. This is the default rule list view, intended for managing rules. You can expand each group to view a list of rules in this group. Expand a rule further to view its details. You can also expand action buttons and alerts resulting from the rule to view their details.

State view

State view shows alert rules grouped by state. Use this view to get an overview of which rules are in what state. Each rule can be expanded to view its details. Action buttons and any alerts generated by this rule, and each alert can be further expanded to view its details.

Filter alert rules

To filter alert rules:

From Select data sources, select a data source. You can see alert rules that query the selected data source.
In the Search by label, enter search criteria using label selectors. For example, environment=production,region=~US|EU,severity!=warning.
From Filter alerts by state, select an alerting state you want to see. You can see alerting rules that match the state. Rules matching other states are hidden.

Create mute timings

Sun, 08 Mar 2026 02:10:29 +0000

Create mute timings

A mute timing is a recurring interval of time when no new notifications for a policy are generated or sent. Use them to prevent alerts from firing a specific and reoccurring period, for example, a regular maintenance period.

Similar to silences, mute timings do not prevent alert rules from being evaluated, nor do they stop alert instances from being shown in the user interface. They only prevent notifications from being created.

You can configure Grafana managed mute timings as well as mute timings for an external Alertmanager data source. For more information, refer to Alertmanager documentation.

Mute timings vs silences

The following table highlights the key differences between mute timings and silences.

Mute timing	Silence
Uses time interval definitions that can reoccur	Has a fixed start and end time
Is created and then added to notification policies	Uses labels to match against an alert to determine whether to silence or not

Create a mute timing

In the left-side menu, click Alerts & IRM, and then Alerting.
Click Notification policies.
From the Alertmanager dropdown, select an external Alertmanager. By default, the Grafana Alertmanager is selected.
Scroll down to the Mute timings section.
Click + Add mute timing.
Fill out the form to create a time interval to match against for your mute timing.
Click Submit to create the mute timing.

Add mute timing to a notification policy

In the left-side menu, click Alerts & IRM, and then Alerting.
Click Notification policies.
Identify the notification policy you would like to add the mute timing to and click the Edit button for that policy.
In the Specific routing section, from the Mute timings dropdown, select the mute timings you would like to add to the route.
Click Save policy.

Time intervals

A time interval is a definition for a moment in time. If an alert fires during this interval it will be suppressed. All fields are lists, and at least one list element must be satisfied to match the field. Fields also support ranges using : (ex: monday:thursday). The fields available for a time interval are: mute timing can contain multiple time intervals. A time interval is a specific duration when alerts are suppressed from firing. The duration typically consists of a specific time range along with days of a week, month, or year.

All properties for the time interval are lists, and at least one list element must be satisfied to match the field. The fields support ranges using `:` (ex: `monday:thursday`). If you leave a field blank, it will match with any moment of time.

Supported time interval options are:

Time range: The time inclusive of the starting time and exclusive of the end time in UTC.
Days of the week: The day or range of days of the week. Example: monday:thursday.
Days of the month: The date 1-31 of a month. Negative values can also be used to represent days that begin at the end of the month. For example: -1 for the last day of the month.
Months: The months of the year in either numerical or the full calendar month. For example: 1, may:august.
Years: The year or years for the interval. For example: 2021:2024.

If a field is left blank, any moment of time will match the field. For an instant of time to match a complete time interval, all fields must match. A mute timing can contain multiple time intervals.

If you want to specify an exact duration, specify all the options. For example, if you wanted to create a time interval for the first Monday of the month, for March, June, September, and December, between the hours of 12:00 and 24:00 UTC your time interval specification would be:

Time range:
- Start time: 12:00
- End time: 24:00
Days of the week: monday
Months: 3, 6, 9, 12
Days of the month: 1:7

View the state and health of alert rules

Sun, 08 Mar 2026 02:10:29 +0000

View the state and health of alert rules

The state and health of alert rules helps you understand several key status indicators about your alerts.

There are three key components: alert rule state, alert instance state, and alert rule health. Although related, each component conveys subtly different information.

To view the state and health of your alert rules:

In the left-side menu, click Alerts & IRM and then Alerting.
Click Alert rules to view the list of existing alerts.
Click an alert rule to view its state, health, and state history.

Alert rule state

An alert rule can be in either of the following states:

State	Description
Normal	None of the time series returned by the evaluation engine is in a `Pending` or `Firing` state.
Pending	At least one time series returned by the evaluation engine is `Pending`.
Firing	At least one time series returned by the evaluation engine is `Firing`.

Note
Alerts will transition first to pending and then firing, thus it will take at least two evaluation cycles before an alert is fired.

Alert instance state

An alert instance can be in either of the following states:

State	Description
Normal	The state of an alert that is neither firing nor pending, everything is working correctly.
Pending	The state of an alert that has been active for less than the configured threshold duration.
Alerting	The state of an alert that has been active for longer than the configured threshold duration.
NoData	No data has been received for the configured time window.
Error	The error that occurred when attempting to evaluate an alerting rule.

Alert rule health

An alert rule can have one the following health statuses:

State	Description
Ok	No error when evaluating an alerting rule.
Error	An error occurred when evaluating an alerting rule.
NoData	The absence of data in at least one time series returned during a rule evaluation.

Special alerts for `NoData` and `Error`

When evaluation of an alerting rule produces state NoData or Error, Grafana Alerting will generate alert instances that have the following additional labels:

Label	Description
alertname	Either `DatasourceNoData` or `DatasourceError` depending on the state.
datasource_uid	The UID of the data source that caused the state.

You can handle these alerts the same way as regular alerts by adding a silence, route to a contact point, and so on.

State history view

Use the State history view to get insight into how your alert instances behave over time. View information on when a state change occurred, what the previous state was, the current state, any other alert instances that changed their state at the same time as well as what the query value was that triggered the change.

Configure the state history view

To enable the state history view, see Configuring alert state history.

View state history

To use the State history view, complete the following steps.

Navigate to Alerts & IRM -> Alerting -> Alert rules.
Click an alert rule.
Select Show state history.

The State history view opens.

The timeline view at the top displays a timeline of changes for the past hour, so you can track how your alert instances are behaving over time.

The bottom part shows the alert instances, their previous and current state, the value of each part of the expression and a unique set of labels.

Common labels are displayed at the top to make it easier to identify different alert instances.
From the timeline view, hover over a time to get an automatic display of all the changes that happened at that particular moment.

These changes are displayed in real time in the timestamp view at the bottom of the page. The timestamp view is a list of all the alert instances that changed state at that point in time. The visualization only displays 12 instances by default.

The value shown for each instance is for each part of the expression that was evaluated.
Click the labels to filter and narrow down the results.

View and filter by alert groups

Sun, 08 Mar 2026 02:10:29 +0000

View and filter by alert groups

Alert groups show grouped alerts from an Alertmanager instance. By default, alert rules are grouped by the label keys for the default policy in notification policies. Grouping common alert rules into a single alert group prevents duplicate alert rules from being fired.

You can view alert groups and also filter for alert rules that match specific criteria.

View alert groups

To view alert groups, complete the following steps.

In the left-side menu, click Alerts & IRM and then Alerting.
Click Groups to view the list of existing groups.
From the Alertmanager dropdown, select an external Alertmanager as your data source. By default, the Grafana Alertmanager is selected.
From Custom group by dropdown, select a combination of labels to view a grouping other than the default. This is useful for debugging and verifying your grouping of notification policies.

If an alert does not contain labels specified either in the grouping of the default policy or the custom grouping, then the alert is added to a catch all group with a header of No grouping.

Filter alerts

You can filter by label or state.

Search by label

In Search, enter an existing label to view alerts matching the label.

For example, environment=production,region=~US|EU,severity!=warning.

Filter by state

In States, select from Active, Suppressed, or Unprocessed states to view alerts matching your selected state. All other alerts are hidden.

View notification errors

Sun, 08 Mar 2026 02:10:29 +0000

View notification errors

View notification errors and understand why they failed to be sent or were not received.

Note: This feature only works if you are using Grafana Alertmanager.

To view notification errors, complete the following steps.

Navigate to Alerting -> Contact points.

If any contact points are failing, a message at the right-hand corner of the screen alerts the user to the fact that there are errors and how many.
Click on the contact point to view the details of errors for each contact point.

Error details are displayed if you hover over the Error icon.

If a contact point has more than one integration, you see all errors for each of the integrations listed.
In the Health column, check the status of the notification.

This can be either OK, No attempts, or Error.

Useful links

Receivers API

Declare incidents from firing alerts

Sun, 08 Mar 2026 02:10:29 +0000

Declare incidents from firing alerts

Declare an incident from a firing alert to streamline your alert to incident workflow.

Before you begin

Ensure you have Grafana Incident installed
You must have a firing alert

Procedure

To declare an incident from a firing alert, complete the following steps.

Navigate to Alerts & Incidents -> Alerting -> Alert rules.
From the Alert rules list view, click the firing alert that you want to declare an incident for.

Note:

You can also access Declare Incident from the alert details page.
Click Declare Incident. The Declare Incident pop-up opens in the Grafana Incident application.
In the Declare Incident pop-up, enter what’s going on.

Note: This field is pre-filled with the name of the alert rule, but you can edit it as required.

The alert rule is also linked to the incident.
Select a severity.
Add labels, as required.
Click More options to include a channel prefix and status.
Click Declare Incident.

Next steps

View and track the incident in the Grafana Incident application.

For more information, refer to Grafana Incident documentation.

Manage your alerts on Grafana Labs

Customize notifications

Customize notifications

Use images in notifications

Use images in notifications

Requirements

Configuration

Advanced configuration

Supported contact points

Limitations

Troubleshooting

Metrics

Manage silences

Manage silences

Add silences

Edit silences

Create a URL to link to a silence form

Remove silences

Useful links

View and filter alert rules

View and filter alert rules

View alert rules

Export alert rules

View query definitions for provisioned alerts

Grouped view

State view

Filter alert rules

Create mute timings

Create mute timings

Mute timings vs silences

Create a mute timing

Add mute timing to a notification policy

Time intervals

View the state and health of alert rules

View the state and health of alert rules

Alert rule state

Alert instance state

Alert rule health

Special alerts for NoData and Error

State history view

Configure the state history view

View state history

View and filter by alert groups

View and filter by alert groups

View alert groups

Filter alerts

Search by label

Filter by state

View notification errors

View notification errors

Useful links

Declare incidents from firing alerts

Declare incidents from firing alerts

Before you begin

Procedure

Next steps

Special alerts for `NoData` and `Error`