Signl4 Actions

Use Signl4 actions to send mobile alerts to your team via Signl4. Signl4 provides mobile push notifications, SMS, and voice calls for critical alerts.

Overview

Signl4 is a mobile alerting service that ensures critical alerts reach the right people via push notifications, SMS, or voice calls. The Signl4 action type in Signals simplifies the configuration by providing:

• A dedicated “Signl4” option in the actions menu
• A URL field pre-filled with the Events API endpoint and placeholder for your team ID
• An API key field for authentication
• A default body format optimized for Signl4

This Signl4 action type is available in the Kibana UI. Via the REST API, create a webhook action as shown in the examples.

Prerequisites

Before you can use Signl4 actions, you need:

1. A Signl4 account - Sign up at signl4.com

2. Your Signl4 Team ID - To get your team ID:
   • Log in to the Signl4 portal
   • Navigate to your team settings
   • Find your Team ID (also called Webhook ID)
3. A Signl4 API key - To create an API key:
   • In the Signl4 portal, go to Integrations → API Keys
   • Create a new API key
   • Copy and save the key securely

The Events API endpoint you’ll use is:

https://connect.signl4.com/api/v2/events/{webhookIdOrTeamId}

Basic Functionality

Using the Kibana UI

When creating a watch in the Kibana UI:

1. Click Add and select Signl4
2. Enter a Name for your action
3. Replace {webhookIdOrTeamId} in the URL with your team ID
4. Enter your API key in the API Key field
5. Customize the Body with your alert message

The default body uses a simple text format that Signl4 parses automatically:

Title: Signals Alert
Message: Watch "{{watch.id}}" was triggered at {{trigger.triggered_time}}
X-S4-ExternalID: {{watch.id}}
X-S4-Service: Security

JSON Format

A Signl4 action in JSON format looks like this:

{
  "actions": [
    {
      "type": "webhook",
      "name": "my_signl4_alert",
      "request": {
        "method": "POST",
        "url": "https://connect.signl4.com/api/v2/events/{webhookIdOrTeamId}",
        "body": "Title: Signals Alert\nMessage: {{data.mysearch.hits.total.value}} hits detected\nX-S4-ExternalID: {{watch.id}}",
        "headers": {
          "Content-Type": "text/plain",
          "X-S4-Api-Key": "your-api-key-here"
        }
      }
    }
  ]
}

Configuration Attributes

For additional configuration options such as throttling, authentication, and TLS settings, see Webhook Actions.

Customizing the Alert Payload

Signl4 accepts both text/plain and application/json payloads.

Text Format (Default)

Use key-value pairs, one per line:

Title: Signals Alert
Message: High error rate: {{data.mysearch.hits.total.value}} errors
X-S4-Service: Signals
X-S4-ExternalID: {{watch.id}}
X-S4-AlertingScenario: single_ack

JSON Format

When using JSON, set the header Content-Type: application/json.

{
  "title": "Signals Alert",
  "message": "High error rate: {{data.mysearch.hits.total.value}} errors",
  "X-S4-Service": "Signals",
  "X-S4-ExternalID": "{{watch.id}}",
  "X-S4-AlertingScenario": "single_ack"
}

Alert Title and Message

In the alert payload, use Title and Message as the parameter names for your alert content. Any additional parameters will be visible in Signl4’s alert details.

Signl4 Control Parameters

Any additional fields you include (e.g., source, severity, environment) will be visible in Signl4’s alert details.

For more details, see:

• Signl4 Webhook Integration
• Signl4 Inbound Webhook Documentation
• Signl4 REST API
• Control Parameters Reference

Using Mustache Templates

You can use Mustache templates to include dynamic data from your watch checks:

Title: {{data.mysearch.hits.total.value}} errors detected
Message: Time: {{trigger.triggered_time}}
X-S4-ExternalID: {{watch.id}}-{{trigger.triggered_time}}

Webhook Endpoint (Alternative)

Alternatively, you can use the Signl4 webhook endpoint directly. This approach uses URL-based authentication and does not require an API key. Use the webhook endpoint:

https://connect.signl4.com/webhook/{webhookIdOrTeamId}

The request body format is the same as for the Events API. Here is a complete example:

{
  "type": "webhook",
  "name": "signl4_webhook",
  "request": {
    "method": "POST",
    "url": "https://connect.signl4.com/webhook/{webhookIdOrTeamId}",
    "body": "{\"Title\": \"{{data.mysearch.hits.total.value}} errors detected\", \"Message\": \"Watch {{watch.id}} triggered\"}",
    "headers": {
      "Content-Type": "application/json"
    }
  }
}

Note: The Events API endpoint with API key authentication is recommended for better security.

Advanced Options

Signl4 actions are built on Webhook Actions. For advanced configuration, refer to the webhook documentation:

• Dynamic Endpoints - Use Mustache templates in the URL
• TLS Configuration - Configure custom certificates
• Security Considerations - Restrict allowed endpoints

Not what you were looking for? Try the search.