Use placeholders in the output field to include dynamic values in your alert messages. Format: %variable (single % prefix, no trailing %).
Important: Use %tx.hash NOT %tx.hash%. Only one % at the beginning!
Available Placeholders
Basic Transaction Fields
| Placeholder | Output Value | Example |
|---|
%tx.hash | Transaction hash | 0xd6343c3d... |
%tx.from | Sender address | 0x2fb074... |
%tx.to | Recipient address | 0x6c3ea9... |
%tx.value | Value in wei (string) | 1000000000000000000 |
%tx.value_eth | Value in ETH (formatted to 4 decimals) | 1.0000 |
%tx.nonce | Transaction nonce | 952 |
%tx.gas | Gas limit | 21000 |
%tx.gas_used | Actual gas consumed | 102876 |
%tx.gas_price | Gas price in wei (string) | 100000000000 |
%tx.gas_price_gwei | Gas price in gwei (formatted to 2 decimals) | 100.00 |
%tx.input | Transaction input data (hex) | 0x095ea7b3... |
%tx.block_number | Block number | 18500000 |
%tx.block_hash | Block hash | 0x1234abcd... |
%tx.tx_index | Transaction index in block | 5 |
%tx.chain | Chain identifier | ethereum |
%tx.status | Transaction status | 1 (success) or 0 (failed) |
%tx.logs_count | Number of event logs | 5 |
%tx.timestamp | Timestamp (RFC3339 format) | 2024-01-15T10:30:00Z |
%tx.timestamp_unix | Unix timestamp (seconds) | 1705312200 |
ERC-20 Event Analysis
These placeholders extract values from ERC-20 Transfer and Approval events in the transaction.
| Placeholder | Output Value | Example |
|---|
%erc20_burn_amount | Total burn amount in ETH (formatted to 2 decimals) | 1000.00 |
%erc20_transfer_amount | Total transfer amount in ETH (formatted to 2 decimals) | 5000.00 |
%erc20_transfer_from | Source address of first transfer | 0x2fb074... |
%erc20_transfer_to | Destination address of first transfer | 0x6c3ea9... |
%get_approval_amount | Approval amount in ETH (formatted to 2 decimals) | 1000000.00 |
ERC-20 Placeholders: These placeholders analyze Transfer and Approval events from the transaction logs. If no matching events are found, the placeholder will remain unchanged in the output.
%tx.value: Raw wei value as string (e.g., "1000000000000000000")%tx.value_eth: Formatted ETH value with 4 decimal places (e.g., "1.0000")%tx.gas_price: Raw gas price in wei as string (e.g., "100000000000")%tx.gas_price_gwei: Formatted gas price in gwei with 2 decimal places (e.g., "100.00")%tx.timestamp: RFC3339 formatted timestamp (e.g., "2024-01-15T10:30:00Z")%tx.timestamp_unix: Unix timestamp in seconds (e.g., "1705312200")- ERC-20 amounts: Formatted with 2 decimal places (e.g.,
"1000.00")
- Numeric fields: All converted to strings (e.g.,
%tx.nonce → "952")
- Address fields: Full address in hex format (e.g.,
%tx.from → "0x2fb074...")
Example Usage
- rule: High Value Transfer
desc: Detects large ETH transfers
tags: ["high-value"]
condition: tx.value > 100 ether
output: >
Large transfer detected!
From: %tx.from
To: %tx.to
Amount: %tx.value_eth ETH
TX: %tx.hash
Block: %tx.block_number (%tx.block_hash)
Gas: %tx.gas_used / %tx.gas
Chain: %tx.chain
Time: %tx.timestamp
priority: WARNING
enabled: true
ERC-20 Token Analysis
- rule: Token Burn Detected
desc: Detects ERC-20 token burns
tags: ["token", "burn"]
condition: >
tx.transfers.any(to == "0x0000000000000000000000000000000000000000000000000000000000000000")
output: >
Token burn detected!
Amount: %erc20_burn_amount ETH
From: %erc20_transfer_from
TX: %tx.hash
priority: WARNING
enabled: true
Best Practices
- Use
%tx.value_eth for human-readable amounts instead of %tx.value (which shows raw wei)
- Include transaction hash (
%tx.hash) for easy lookup on block explorers
- Use ERC-20 placeholders when working with token transfers and approvals
- Format consistently - numeric placeholders are already formatted, don’t add extra formatting
Next Steps
