Pagerduty Custom Details Option is Misleading and Limiting

[mark-trellix]

My initial thoughts were that I could put anything under pagerduty_v2_payload_custom_details option to have it show up on my pagerduty alert.

elastalert2/docs/source/alerts.rst

Lines 1898 to 1899 in 55e2659

	``pagerduty_v2_payload_custom_details``: List of keys:values to use as the content of the custom_details payload. Example - ip:clientip will map the value from the clientip index of Elasticsearch to JSON key named ip.

For example:

      pagerduty_v2_payload_custom_details:
          rule_name: "service-not-healthy"
          test: "test1"

But what happens is that on the pageryduty alert side these key's values are set to null.

custom details
information	...
rule_name	null
test	null

After tinkering around I've concluded the pagerduty alert option pagerduty_v2_payload_custom_details only allows values that match keys of the elastalert matches based off this code snippet...

elastalert2/elastalert/alerters/pagerduty.py

Lines 50 to 53 in 55e2659

	if self.pagerduty_v2_payload_custom_details:
	for match in matches:
	for custom_details_key, es_key in list(self.pagerduty_v2_payload_custom_details.items()):
	custom_details_payload[custom_details_key] = lookup_es_key(match, es_key)

Example of an elastalert match to find keys in for custom details payload :
{'@timestamp': '2025-05-30T21:40:19.987435Z', 'num_hits': 6, 'num_matches': 1}

It's neat to be able to reference the value of a elastalert match key, but is there a reason why we are restricted to whatever is in the elastalert match and that we can't put whatever we want for custom details?

[jertel]

I agree, that does seem overly limiting. If you'd like to submit a PR to support falling back to the static value when it's not found in the match I would support that.

Perhaps something like:

custom_details_payload[custom_details_key] = lookup_es_key(match, es_key) or es_key

The contribution guidelines explain the requirements for submitting a PR.

[mark-trellix]

Sounds good. I will look into making changes to accommodate this.

[mark-trellix]

Created a PR #1674