HTTPGetJSON performs an HTTP request to the specified URL and returns a jsonq.JsonQuery object for use in the alert template. Example:
template example {
{{ $ip := 8.8.8.8 }}
{{ $whoisURL := printf "http://whois.arin.net/rest/ip/%s" $ip }}
{{ $whoisJQ := $.HTTPGetJSON $whoisURL }}
IP {{$ip}} owner from ARIN is {{ $whoisJQ.String "net" "orgRef" "@name" }}
}
In this case the $ip address is hard coded but in a real alert it would usually come from the alert tags using something like {{ $ip := .Group.client_ip}}
where client_ip is a tag key whose value is an IP address.
The jsonq results are similar to the results generated by the jq JSON processor, so you can test in a BASH shell using:
$ curl -H "Accept: application/json" http://whois.arin.net/rest/ip/8.8.8.8 | jq ".net.orgRef"
{
"@handle": "GOGL",
"@name": "Google Inc.",
"$": "https://whois.arin.net/rest/org/GOGL"
}