How do I set the event type, summary and timestamp of events from my own webhook payloads?

Tares lets you set all three on a webhook source with four config fields: event_type, event_type_field, text_template and event_time_field. Use event_type for one fixed type (default webhook_event) or event_type_field to read the type from a payload field such as action. Use text_template to render the summary from payload fields and event_time_field to name the payload field that holds an ISO-8601 timestamp.

How it works

The webhook connector stores every payload lossless. Four optional fields in the source config decide how each posted payload becomes an event:

• event_type is a fixed event type for every event from the source. The default is webhook_event.
• event_type_field names the payload field to read the event type from, for example action. Use it when one producer sends different kinds of events and you want each event labeled by its own value.
• text_template is a render template over payload fields. It builds the event summary from the fields you name in the template.
• event_time_field names the payload field that holds an ISO-8601 event timestamp.

These fields work alongside labels. Labels map payload fields into the envelope so you can correlate on them, and you mark one label primary. The template and the type field are about what the event says and what kind it is. Labels are about which entity it belongs to. Tares uses all of this in the monitoring flows described in AI SRE.

Set it up

1. Create a webhook source. In the console go to Sources, then Add source, then webhook. You can also ask a connected agent to create it, or POST /api/sources with the same object. The response includes the ingest_key.
2. Add the type and summary fields to the source config, and declare a label for each payload field you want to correlate on:

- name: ci-events
  connector: webhook
  config:
    event_type_field: action
    text_template: '{action} by {sender}'
    labels:
      - { name: pipeline, field: pipeline, primary: true }

Here the type is read from the action field, and the summary template reads the action and sender fields. 3. If you want one fixed type instead, set event_type and leave out event_type_field. Omit both and events get the default type webhook_event. 4. If your payload carries a timestamp, name that field in event_time_field. The field must hold an ISO-8601 value. The field name occurred_at below is an example, use the name your payload has:

- name: ci-events
  connector: webhook
  config:
    event_type: webhook_event
    event_time_field: occurred_at
    labels:
      - { name: pipeline, field: pipeline, primary: true }

5. Save the source and copy the ingest endpoint from the source page. Point your producer at it. A producer can post one JSON object, a list, or NDJSON to the path /ingest/ followed by your ingest key:

curl -X POST http://localhost:8787/ingest/<ingest_key> \
  -H 'Content-Type: application/json' \
  -d '{"action": "deploy", "sender": "ci", "pipeline": "web"}'

6. When Tares has auth on, the sender uses a Bearer Authorization header holding an ingest-scoped API key. Creating a push source in the console mints one for it and shows it once.
7. Check the result. Use test_source with a sample payload to check the mapping before you wire up the producer. After you post a real payload, open Recent events to see the event, and open Fields to see which payload fields arrive and how often.

What you get

• Events from your own services carry a type you chose, either fixed or taken from a payload field such as action.
• Each event has a summary built from the payload fields you name in the template, so you can read events without opening the raw payload.
• Events can carry the time your producer reports, from the field you name in event_time_field.
• The full payload stays stored lossless, so the fields you did not use in a template or label are still there.
• The Fields view shows which payload fields arrive and how often, which helps you pick a reliable field for the type, the labels and the primary key.

When something else fits

• If the sender is Prometheus Alertmanager, use the alertmanager connector. It has its own ingest URL and takes the alert payload as it is.
• If you do not control the payload and only need to pull a JSON endpoint on a schedule, the http_poll connector has similar fields (event_type, event_type_field, text_template, event_time_field, id_field) and Tares fetches the data itself.
• For the full field list and the other options, see the webhook connector page.

Related