Webhook

This page documents a legacy sink in Robusta classic

For new setups, we recommend HolmesGPT instead.

HolmesGPT triages your alerts instead of just forwarding them. Sinks are deterministic: they send every notification, unchanged, to a fixed destination, leaving you to read and prioritize each one yourself.

HolmesGPT instead uses AI to investigate each alert, surface the likely root cause, and escalate only what needs attention — so you get fewer, more actionable notifications. Set this up with Alerts Triage for alerts, or Triggered Workflows for custom events.

Robusta can report issues and events in your Kubernetes cluster to a webhook.

Add this to your generated_values.yaml

sinksConfig:
- webhook_sink:
    name: webhook_sink
    url: "https://my-webhook-service.com/robusta-alerts"

Save the file and run

 helm upgrade robusta robusta/robusta --values=generated_values.yaml

Example Output:

This example is sending Robusta notifications to ntfy.sh, push notification service

Configuration parameters

Field

Default

Description

url

(required)

The webhook endpoint to POST to.

format

text

Payload format. text for a human-readable body, json for a structured body.

size_limit

4096

Maximum payload size in bytes. Content beyond the limit is truncated.

authorization

(none)

Optional value sent in the Authorization request header.

slack_webhook

false

When true and format: json, posts a Slack-compatible body for use with Slack incoming webhooks.

JSON payload

When format: json is set, the POST body is a JSON object with the following top-level fields:

{
  "title": "CrashLoopBackOff",
  "description": "Container is crashing repeatedly",
  "cluster_name": "prod-eu-west",
  "account_id": "abcd-1234",
  "severity": "HIGH",
  "source": "KUBERNETES_API_SERVER",
  "finding_type": "ISSUE",
  "aggregation_key": "CrashLoopBackOff",
  "failure": true,
  "fingerprint": "2c1d...",
  "starts_at": "2026-04-30T10:15:00+00:00",
  "ends_at": null,
  "subject": {
    "name": "my-pod",
    "kind": "pod",
    "namespace": "default",
    "node": "node-1",
    "container": "main",
    "labels": {"app": "demo"},
    "annotations": {"team": "platform"}
  },
  "links": [
    {"name": "Runbook", "url": "https://...", "type": null},
    {"name": "Graph",   "url": "https://...", "type": "prometheus_generator_url"}
  ],
  "investigate": "https://platform.robusta.dev/...",
  "silence": "https://platform.robusta.dev/silences/create?...",
  "enrichments": [ ... ]
}

investigate and silence are present only when the Robusta platform is enabled (silence additionally requires add_silence_url on the finding).

If the serialized payload exceeds size_limit, the largest field (enrichments) is dropped first so that core metadata and links survive truncation.