HTTPGetJSON performs an HTTP request to the specified URL and returns a jsonq.JsonQuery object for use in the alert template. Example:

template example {
    {{ $ip := }} 
    {{ $whoisURL := printf "" $ip }}
    {{ $whoisJQ := $.HTTPGetJSON $whoisURL }}
    IP {{$ip}} owner from ARIN is {{ $whoisJQ.String "net" "orgRef" "@name" }}

In this case the $ip address is hard coded but in a real alert it would usually come from the alert tags using something like {{ $ip := .Group.client_ip}} where client_ip is a tag key whose value is an IP address.

The jsonq results are similar to the results generated by the jq JSON processor, so you can test in a BASH shell using:

$ curl -H "Accept: application/json" | jq  ".net.orgRef"
  "@handle": "GOGL",
  "@name": "Google Inc.",
  "$": ""