The format of a VMware Aria Operations for Logs webhook depends on the type of query from which it is created. System notifications, user alert message queries, and alerts generated from aggregate user queries each have a different webhook format.

Note: To configure VMware Aria Operations for Logs to send system notifications, you must be a user associated with the Super Admin role, or a role with the relevant permissions. For more information, see Create and Modify Roles.

Webhook Format for System Notifications

The following example shows the VMware Aria Operations for Logs webhook format for system notifications.
	
{
   "AlertName":" Admin Alert: Worker node has returned to service  (Host = 127.0.0.2)",
   "messages":[
      {
         "text":"This notification was generated from Operations for Logs node (Host = 127.0.0.2,  
	Node Identifier = a31cad22-65c2-4131-8e6c-27790892a1f9).
	A worker node has returned to service after having been in maintenance mode. 
	The Operations for Logs primary node reports that worker node has finished maintenance 
	and exited maintenance mode. The node will resume receiving configuration changes and 
	serving queries. The node is also now ready to start receiving incoming log messages."

         "timestamp":1458665320514,"fields":[]
      }
   ]
}