Open in ChatGPTOpen in Claude

notification.deliveries

Purpose

The notification.deliveries dataset logs Notification Center delivery events. Alerts record delivery failures, while Cases record both successful and failed deliveries. This dataset is enabled by default for all environments and is hosted by Coralogix at no additional cost.

Use this dataset to monitor delivery success and failure rates, diagnose issues with notification routing, and audit the overall performance of your notification system.

Tip

To explore delivery events in the UI instead of querying the dataset directly, use Notification Deliveries (Early Access).

Schema description

Show schema description

Full JSON path	Field data type	Field data example	description
notificationCenter	Object	{ ... }	Container for Notification Center envelope fields.
notificationCenter.$l	Object	{"team":"SRE","service":"payments-api","env":"prod"}	Entity labels copied from the originating notification request.
notificationCenter.$m	Object	{ ... }	Metadata block for this delivery event.
notificationCenter.$m.cxEventId	String (UUID)	"76c411be-6e4d-4fb1-a987-5fce042deaaf"	Unique Coralogix event identifier for this delivery record.
notificationCenter.$m.ingressTimestamp	String (Date)	"2025-08-10T14:23:01Z"	Time the event was ingested.
notificationCenter.$m.timestamp	String (Date)	"2025-08-10T14:23:00Z"	Timestamp when this delivery event was recorded.
notificationCenter.$m.severity	Enum	"Error"	Delivery severity derived from outcome.status (Info or Error).
notificationCenter.$m.priorityClass	String	"medium"	Delivery priority classification.
notificationCenter.$d	Object	{ ... }	Delivery-specific identifiers and source linkage.
notificationCenter.$d.notificationDeliveryId	String	"deliv-01H8F2J7Q0A3"	Unique identifier for this specific delivery attempt/record.
notificationCenter.$d.source	Object	{ ... }	Originating request identifiers and entity context.
notificationCenter.$d.source.requestDeduplicationId	String (UUID)	"3f2504e0-4f89-11d3-9a0c-0305e82c3301"	Deduplication ID from the originating request.
notificationCenter.$d.source.notificationId	String (UUID)	"6fa459ea-ee8a-3ca4-894e-db77e160355e"	Notification ID from the originating request.
notificationCenter.$d.source.requestTimestamp	String (Date)	"2025-08-10T14:20:00Z"	Timestamp of the originating notification request.
notificationCenter.$d.source.entityType	String	"alert"	Source entity type from the request.
notificationCenter.$d.source.entitySubType	String	"threshold"	Source entity subtype from the request.
notificationCenter.$d.source.entityId	String (optional)	"alert-01H8F2J7Q0A3"	Unique identifier for the source entity.
notificationCenter.$d.source.entityUrl	String (URI, optional)	"https://example.app.coralogix.com/#/alerts/alert-01H8F2J7Q0A3"	URL of the source entity.
destination	Object	{ "type":"slack", "payloadType":"slack", "connectorInfo":{...}, "presetInfo":{...} }	Delivery destination details.
destination.type	String	"slack"	Destination channel/category (e.g., slack, email, webhook).
destination.payloadType	String	"slack"	Type of payload sent to the destination.
destination.connectorInfo	Object	{ "id":"conn-123", "name":"Slack" }	Information about the connector used.
destination.connectorInfo.id	String	"conn-123"	Internal connector identifier.
destination.connectorInfo.name	String	"Slack"	Connector display name.
destination.presetInfo	Object	{ "id":"preset-9", "type":"Custom", "name":"#oncall" }	Preset configuration details, if used.
destination.presetInfo.id	String	"preset-9"	Internal preset identifier.
destination.presetInfo.type	Enum	"Custom"	Preset type: System or Custom.
destination.presetInfo.name	String	"#oncall"	Preset display name.
message	String	"Alert: CPU usage is high!"	Optional human-readable message or summary for the delivery.
content	Object	{ "templated": { ... } }	Template inputs used to render message and connector payloads.
content.templated	Object	{ "messageConfig":"Alert: { alert.name }", "connectorConfig":"{ \"channel\":\"#oncall\" }" }	Serialized template inputs.
content.templated.messageConfig	String	"Alert: { alert.name }"	Message configuration used for templating.
content.templated.connectorConfig	String	"{ \"channel\":\"#oncall\", \"mention\":\"@oncall\" }"	Connector-specific template inputs.
content.rendered	Object	{ "messageConfig":"...", "messageConfigRenderingInfo":{...}, "connectorConfig":"...", "connectorConfigRenderingInfo":{...} }	Rendered outputs after template resolution.
content.rendered.messageConfig	String	"Alert: CPU usage is high!"	Rendered message payload.
content.rendered.messageConfigRenderingInfo	Object	{ "status":"Success", "sourceOverrides":[...] }	Structured info about message rendering.
content.rendered.messageConfigRenderingInfo.status	Enum	"Success"	Message rendering status: Success or FallbackApplied.
content.rendered.messageConfigRenderingInfo.statusReason	String	"template var missing: alert.name"	Reason for the rendering status.
content.rendered.messageConfigRenderingInfo.sourceOverrides	Array/Object	[{ "fieldName":"text", "template":"{{alert.name}}" }]	Field-level overrides applied from the source.
content.rendered.messageConfigRenderingInfo.sourceOverrides[].fieldName	String	"text"	Name of the overridden field.
content.rendered.messageConfigRenderingInfo.sourceOverrides[].template	String	"{{alert.name}}"	Template content for the field.
content.rendered.messageConfigRenderingInfo.renderingErrors	Array/Object	[{ "message":"template var missing: alert.name" }]	Errors encountered while rendering the message template.
content.rendered.messageConfigRenderingInfo.renderingErrors[].message	String	"template var missing: alert.name"	Error message from rendering the message template.
content.rendered.connectorConfig	String	"{ \"channel\":\"#oncall\" }"	Rendered connector payload/config.
content.rendered.connectorConfigRenderingInfo	Object	{ "status":"Success", "sourceOverrides":[...], "entityOverrides":[...] }	Structured info about connector rendering.
content.rendered.connectorConfigRenderingInfo.status	Enum	"Success"	Connector rendering status: Success or FallbackApplied.
content.rendered.connectorConfigRenderingInfo.sourceOverrides	Array/Object	[{ "fieldName":"channel", "template":"#oncall" }]	Field-level overrides applied from the source.
content.rendered.connectorConfigRenderingInfo.sourceOverrides[].fieldName	String	"channel"	Name of the overridden field.
content.rendered.connectorConfigRenderingInfo.sourceOverrides[].template	String	"#oncall"	Template content for the field.
content.rendered.connectorConfigRenderingInfo.entityOverrides	Array/Object	[{ "fieldName":"channel", "template":"#sre" }]	Field-level overrides applied from the entity.
content.rendered.connectorConfigRenderingInfo.entityOverrides[].fieldName	String	"channel"	Name of the overridden field.
content.rendered.connectorConfigRenderingInfo.entityOverrides[].template	String	"#sre"	Template content for the field.
content.rendered.connectorConfigRenderingInfo.renderingErrors	Array/Object	[{ "message":"invalid channel name" }]	Errors encountered while rendering the connector template.
content.rendered.connectorConfigRenderingInfo.renderingErrors[].message	String	"invalid channel name"	Error message from rendering the connector template.
routing	Object	{ ... }	Routing metadata used to select destination.
routing.routerInfo	Object	{ "id":"router-01","name":"Primary Notifications Router","evaluationMode":"Sequential" }	Router identification.
routing.routerInfo.id	String	"router-01"	Router ID used to select the destination.
routing.routerInfo.name	String	"Primary Notifications Router"	Router name.
routing.routerInfo.evaluationMode	Enum	"Sequential"	Router evaluation mode: Sequential or Parallel.
routing.matchingRuleType	Enum	"RuleMatched"	Type of matching rule: RuleMatched or FallbackUsed.
routing.matchingRule	Object	{ "name":"pagerduty-high","condition":"severity >= 3" }	The rule that matched for this delivery.
routing.matchingRule.name	String	"pagerduty-high"	Name of the rule that matched.
routing.matchingRule.condition	String	"severity >= 3"	Rule condition/expression that evaluated to a match.
outcome	Object	{ ... }	Final outcome and per-attempt details.
outcome.timestamp	String (Date)	"2025-08-10T14:23:30Z"	Timestamp when the delivery outcome was finalized.
outcome.durationMs	Number	500	Duration of the delivery execution (ms).
outcome.e2eDuration	Number	3000	End-to-end duration from request registration to outcome (ms).
outcome.protocol	String	"https"	Delivery protocol used (e.g., https, smtp, slack-api).
outcome.https	Object	{ "responseStatusCode": 200 }	HTTPS-specific response details, if applicable.
outcome.https.responseStatusCode	Integer	200	HTTP status code returned by the destination.
outcome.status	Enum	"Success"	Final outcome status: Success, Discarded, Failure, InternalFailure, or Rejected.
outcome.status_reasons	Object	{ "type":"Timeout","message":"Request timed out after 10 seconds" }	Reason for the final status (category + message).
outcome.status_reasons.type	String	"Timeout"	Machine-friendly reason/category for the status.
outcome.status_reasons.message	String	"Request timed out after 10 seconds"	Human-readable explanation of the status.
outcome.sendingAttempts	Array/Object	[{"timestamp":1754835785000000000,"durationMs":300,"status":"Failure","status_reasons":{"type":"Timeout","message":"Request timed out"},"protocol":"https","https":{"responseStatusCode":504}}]	Per-attempt execution details (retries, backoffs, etc.).
outcome.sendingAttempts[].timestamp	Number	1754835785000000000	Unix epoch timestamp for the individual attempt, in nanoseconds.
outcome.sendingAttempts[].durationMs	Number	300	Attempt duration in milliseconds.
outcome.sendingAttempts[].status	String	"Failure"	Attempt status (often mirrors final outcome.status on last try).
outcome.sendingAttempts[].status_reasons	Object	{ "type":"Timeout","message":"Request timed out after 10 seconds" }	Reason for the attempt status.
outcome.sendingAttempts[].status_reasons.type	String	"Timeout"	Machine-friendly reason/category for the attempt status.
outcome.sendingAttempts[].status_reasons.message	String	"Request timed out after 10 seconds"	Human-readable explanation of the attempt status.
outcome.sendingAttempts[].protocol	String	"https"	Protocol used on the attempt.
outcome.sendingAttempts[].https	Object	{ "responseStatusCode": 504 }	HTTPS-specific response details for the attempt.
outcome.sendingAttempts[].https.responseStatusCode	Integer	504	HTTP status code returned on the attempt.

How the data in this dataset can be used

Auditing notification events

By grouping notification delivery records by their outcome status and counting them, this query shows which results (e.g., delivered, failed) happen most often, ranked from most to least frequent.

Example query:

source system/notification.deliveries
| groupby outcome.status
    aggregate count() as deliveries
| sortby deliveries desc

notification.deliveries schema

The notification.deliveries dataset stores the history of notifications sent or attempted using Coralogix's Notification Center.

Show full schema

{ `notificationCenter`

`$l`

type: object
Entity labels copied from the originating notification request.

{ `$m`

`cxEventId`

type: string (format: uuid)
Unique Coralogix event identifier for this delivery record.

`ingressTimestamp`

type: string
Time the event was ingested.

`timestamp`

type: string
Timestamp when this delivery event was recorded.

`severity`

Enum: Info, Error
Delivery severity derived from outcome.status.

`priorityClass`

type: string
Delivery priority classification (e.g., medium).

}

{ `$d`

`notificationDeliveryId`

type: string
Unique identifier for this specific delivery attempt/record.

{ `source`

`requestDeduplicationId`

type: string
Deduplication ID from the originating request.

`notificationId`

type: string
Notification ID from the originating request.

`requestTimestamp`

type: string
Timestamp of the originating notification request.

`entityType`

type: string
Source entity type from the request.

`entitySubType`

type: string
Source entity subtype from the request.

`entityId`

type: string (optional)
Unique identifier for the source entity.

`entityUrl`

type: string (format: uri, optional)
URL of the source entity.

}

}

}

{ `destination`

`type`

type: string
Destination channel/category (e.g., slack, email, webhook).

`payloadType`

type: string
Type of payload sent to the destination.

{ `connectorInfo`

`id`

type: string
Internal connector identifier.

`name`

type: string
Connector display name.

}

{ `presetInfo`

`id`

type: string
Internal preset identifier.

`type`

Enum: System, Custom
Preset type.

`name`

type: string
Preset display name.

}

}

`message`

type: string
Optional human-readable message or summary for the delivery.

{ `content`

{ `templated`

`messageConfig`

type: string
Serialized template inputs for message content.

`connectorConfig`

type: string
Serialized template inputs for connector-specific options.

}

{ `rendered`

`messageConfig`

type: string
Rendered message payload after template resolution.

{ `messageConfigRenderingInfo`

`status`

Enum: Success, FallbackApplied
Message rendering status.

`statusReason`

type: string
Reason for the rendering status.

{ `sourceOverrides[]`

`fieldName`

type: string
Name of the overridden field.

`template`

type: string
Template content for the field.

}

{ `renderingErrors[]`

`message`

type: string
Error message from rendering the message template.

}

}

`connectorConfig`

type: string
Rendered connector payload/config after template resolution.

{ `connectorConfigRenderingInfo`

`status`

Enum: Success, FallbackApplied
Connector rendering status.

{ `sourceOverrides[]`

`fieldName`

type: string
Name of the overridden field.

`template`

type: string
Template content for the field.

}

{ `entityOverrides[]`

`fieldName`

type: string
Name of the overridden field.

`template`

type: string
Template content for the field.

}

{ `renderingErrors[]`

`message`

type: string
Error message from rendering the connector template.

}

}

}

}

{ `routing`

{ `routerInfo`

`id`

type: string
Router ID used to select the destination.

`name`

type: string
Router name.

`evaluationMode`

Enum: Sequential, Parallel
Router evaluation mode.

}

`matchingRuleType`

Enum: RuleMatched, FallbackUsed
Type of matching rule.

{ `matchingRule`

`name`

type: string
Name of the rule that matched.

`condition`

type: string
Rule condition/expression that evaluated to a match.

}

}

{ `outcome`

`timestamp`

type: string
Timestamp when the delivery outcome was finalized.

`durationMs`

type: number
Duration of the delivery execution (ms).

`e2eDuration`

type: number
End-to-end duration from request registration to outcome (ms).

`protocol`

type: string
Delivery protocol used (e.g., https, smtp, slack-api).

{ `https`

`responseStatusCode`

type: integer
HTTP status code returned by the destination (if applicable).

}

`status`

Enum: Success, Discarded, Failure, InternalFailure, Rejected
Final outcome status for this delivery.

{ `status_reasons`

`type`

type: string
Machine-friendly reason/category for the status.

`message`

type: string
Human-readable explanation of the status.

}

{ `sendingAttempts[]`

`timestamp`

type: number
Unix epoch timestamp for the individual attempt, in nanoseconds.

`durationMs`

type: number
Attempt duration in milliseconds.

`status`

Enum: Success, Discarded, Failure, InternalFailure, Rejected
Attempt status.

{ `status_reasons`

`type`

type: string
Machine-friendly reason/category for the attempt status.

`message`

type: string
Human-readable explanation of the attempt status.

}

`protocol`

type: string
Protocol used on the attempt.

{ `https`

`responseStatusCode`

type: integer
HTTP status code returned on the attempt.

}

}

}

Full field reference

The table lists every field in the dataset schema, with its type and whether every event carries it.

Show full field reference

Field	Type	Required	Description
$d	object	Yes	Schema for notification delivery tracking and metadata
$d.content	object	Yes
$d.content.rendered	object	Yes
$d.content.rendered.connectorConfig	string	Yes	Rendered connector configuration
$d.content.rendered.connectorConfigRenderingInfo	object	Yes
$d.content.rendered.connectorConfigRenderingInfo.entityOverrides	array of object	Yes
$d.content.rendered.connectorConfigRenderingInfo.entityOverrides[].fieldName	string	Yes	Field name
$d.content.rendered.connectorConfigRenderingInfo.entityOverrides[].template	string	Yes	Template content (REDACTED if sensitive)
$d.content.rendered.connectorConfigRenderingInfo.renderingErrors	array of object	No
$d.content.rendered.connectorConfigRenderingInfo.renderingErrors[].message	string	Yes	Error message
$d.content.rendered.connectorConfigRenderingInfo.sourceOverrides	array of object	Yes
$d.content.rendered.connectorConfigRenderingInfo.sourceOverrides[].fieldName	string	Yes	Field name
$d.content.rendered.connectorConfigRenderingInfo.sourceOverrides[].template	string	Yes	Template content (REDACTED if sensitive)
$d.content.rendered.connectorConfigRenderingInfo.status	string	Yes	Rendering status One of: Success, FallbackApplied.
$d.content.rendered.messageConfig	string	Yes	Rendered message configuration
$d.content.rendered.messageConfigRenderingInfo	object	Yes
$d.content.rendered.messageConfigRenderingInfo.renderingErrors	array of object	No
$d.content.rendered.messageConfigRenderingInfo.renderingErrors[].message	string	Yes	Error message
$d.content.rendered.messageConfigRenderingInfo.sourceOverrides	array of object	Yes
$d.content.rendered.messageConfigRenderingInfo.sourceOverrides[].fieldName	string	Yes	Field name
$d.content.rendered.messageConfigRenderingInfo.sourceOverrides[].template	string	Yes	Template content
$d.content.rendered.messageConfigRenderingInfo.status	string	Yes	Rendering status One of: Success, FallbackApplied.
$d.content.rendered.messageConfigRenderingInfo.statusReason	string	No	Reason for the status
$d.content.templated	object	Yes
$d.content.templated.connectorConfig	string	Yes	Templated connector configuration
$d.content.templated.messageConfig	string	Yes	Templated message configuration
$d.destination	object	Yes
$d.destination.connectorInfo	object	Yes
$d.destination.connectorInfo.id	string	Yes	Connector ID
$d.destination.connectorInfo.name	string	Yes	Connector name
$d.destination.payloadType	string	Yes	Type of payload
$d.destination.presetInfo	object	Yes
$d.destination.presetInfo.id	string	Yes	Preset ID
$d.destination.presetInfo.name	string	Yes	Preset name
$d.destination.presetInfo.type	string	Yes	Type of preset One of: System, Custom.
$d.destination.type	string	Yes	Type of destination
$d.message	string	Yes	The notification message
$d.notificationDeliveryId	string (uuid)	Yes	Unique identifier for the notification delivery
$d.outcome	object	Yes
$d.outcome.durationMs	number	Yes	Duration in milliseconds
$d.outcome.e2eDuration	number	Yes	End-to-end duration
$d.outcome.https	object	Yes
$d.outcome.https.responseStatusCode	integer	Yes	HTTP response status code
$d.outcome.protocol	string	Yes	Protocol used Value: https.
$d.outcome.sending_attempts	array of object	Yes
$d.outcome.sending_attempts[].durationMs	number	Yes	Attempt duration in milliseconds
$d.outcome.sending_attempts[].https	object	Yes
$d.outcome.sending_attempts[].https.responseStatusCode	integer	Yes	HTTP response status code
$d.outcome.sending_attempts[].protocol	string	Yes	Protocol used Value: https.
$d.outcome.sending_attempts[].status	string	Yes	Attempt status One of: Success, Discarded, Failure, InternalFailure, Rejected.
$d.outcome.sending_attempts[].statusReason	object	Yes
$d.outcome.sending_attempts[].statusReason.message	string	Yes	Status reason message
$d.outcome.sending_attempts[].statusReason.type	string	Yes	Type of status reason
$d.outcome.sending_attempts[].timestamp	number	Yes	Attempt timestamp
$d.outcome.status	string	Yes	Delivery status One of: Success, Discarded, Failure, InternalFailure, Rejected.
$d.outcome.statusReason	object	Yes
$d.outcome.statusReason.message	string	Yes	Status reason message
$d.outcome.statusReason.type	string	Yes	Type of status reason
$d.outcome.timestamp	string (date-time)	Yes	Outcome timestamp
$d.routing	object	No
$d.routing.matchingRule	object	No
$d.routing.matchingRule.condition	string	Yes	Rule condition
$d.routing.matchingRule.name	string	No	Rule name
$d.routing.matchingRuleType	string	No	Type of matching rule One of: RuleMatched, FallbackUsed.
$d.routing.routerInfo	object	Yes
$d.routing.routerInfo.evaluationMode	string	Yes	Evaluation mode for the router One of: Sequential, Parallel.
$d.routing.routerInfo.id	string	Yes	Router ID
$d.routing.routerInfo.name	string	Yes	Router name
$d.source	object	Yes
$d.source.entityId	string	No	Unique identifier for the entity
$d.source.entitySubType	string	Yes	Subtype of the entity
$d.source.entityType	string	Yes	Type of the entity
$d.source.entityUrl	string (uri)	No	URL of the entity
$d.source.notificationId	string (uuid)	Yes	Unique identifier for the notification
$d.source.requestDeduplicationId	string (uuid)	Yes	Deduplication ID for the request
$d.source.requestTimestamp	string (date-time)	Yes	Timestamp of the request
$l	map	Yes	User labels: free-form string-to-string map
$l.<key>	string	No
$m	object	Yes	Engine metadata
$m.cxEventId	string (uuid)	Yes	Globally unique event id
$m.ingressTimestamp	string (date-time)	Yes	Time the event was ingested
$m.priorityClass	string	Yes	Defines the feature-set enabled for the event One of: high, medium, low.
$m.severity	string	Yes	Event severity level One of: Verbose, Debug, Info, Warning, Error, Critical.
$m.timestamp	string (date-time)	Yes	Event timestamp

Next steps

Manage which system datasets are ingested and visible with Dataset management.