Slack event handler

Slack is a widely used “digital workspace” that facilitates communication among team members. Kapacitor can be configured to send alert messages to Slack.


Configuration as well as default option values for the Slack event handler are set in your kapacitor.conf. Below is an example configuration:

  enabled = true
  default = true
  workspace = ""
  url = ""
  token = "mY5uP3Rs3CrE7t0keN"
  channel = "#alerts"
  username = "kapacitor"
  global = false
  state-changes-only = false
  ssl-ca = "/path/to/ca.crt"
  ssl-cert = "/path/to/cert.crt"
  ssl-key = "/path/to/private-key.key"
  insecure-skip-verify = false

Multiple Slack clients may be configured by repeating [[slack]] sections. The workspace acts as a unique identifier for each configured Slack client.


Set to true to enable the Slack event handler.


Identify one of the Slack configurations as the default if there are multiple Slack configurations.


Slack workspace ID. This can be any string that identifies this particular Slack configuration. A logical choice is the name of the Slack workspace, e.g. <workspace>


Slack webhook URL. For new Slack apps, use For legacy Slack Incoming Webhooks, add a new webhook for Kapacitor and Slack will provide the webhook URL.


Slack OAuth token used with new Slack apps. For legacy Incoming Webhooks, leave token as an empty string ("").


Default channel for messages.


Slack bot username.


If true all the alerts will be sent to Slack without explicitly specifying Slack in the TICKscript.


Sets all alerts in state-changes-only mode, meaning alerts will only be sent if the alert state changes. Only applies if global is true.


Path to certificate authority file.


Path to host certificate file.


Path to certificate private key file.


Use SSL but skip chain and host verification. This is necessary if using a self-signed certificate.


The following Slack event handler options can be set in a handler file or when using .slack() in a TICKscript.

workspacestringSpecifies which Slack configuration to use when there are multiple.
channelstringSlack channel in which to post messages. If empty uses the channel from the configuration.
usernamestringUsername of the Slack bot. If empty uses the username from the configuration.
icon-emojistringIconEmoji is an emoji name surrounded in ‘:’ characters. The emoji image will replace the normal user icon for the slack bot.

Example: handler file

id: handler-id
topic: topic-name
kind: slack
  workspace: ''
  channel: '#alerts'
  username: 'kapacitor'
  icon-emoji: ':smile:'

Example: TICKscript

  // ...

Slack Setup

Legacy Slack apps

To send alerts from Kapacitor to Slack using Slack’s legacy incoming webhooks:

  1. Log into to your Slack workspace
  2. Create a new incoming webhook for Kapacitor.
  3. Add the generated webhook URL as the url in the [[slack]] configuration section of your kapacitor.conf.

New Slack apps

To send alerts from Kapacitor to Slack using a new Slack app:

  1. Visit
  2. Create a new app or click on an existing app.
  3. Click OAuth & Permissions to find the token.

Ensure your app has ‘chat:write’ and ‘chat:write.public’ permissions.

Using the Slack event handler

With one or more Slack event handlers enabled and configured in your kapacitor.conf, use the .slack() attribute in your TICKscripts to send alerts to Slack or define a Slack handler that subscribes to a topic and sends published alerts to Slack.

To avoid posting a message every alert interval, use AlertNode.StateChangesOnly so only events where the alert changed state are sent to Slack.

The examples below use the following Slack configurations defined in the kapacitor.conf:

Slack settings in kapacitor.conf
  enabled = true
  default = true
  workspace = "alerts"
  url = ""
  token = "mY5uP3Rs3CrE7t0keN1"
  channel = "#alerts"
  username = "AlertBot"
  global = false
  state-changes-only = false

  enabled = true
  default = false
  workspace = "error-reports"
  url = ""
  token = "mY5uP3Rs3CrE7t0keN2"
  channel = "#error-reports"
  username = "StatsBot"
  global = false
  state-changes-only = false

Send alerts to Slack from a TICKscript

The following TICKscript uses the .slack() event handler to send the message, “Hey, check your CPU”, to the #alerts Slack channel whenever idle CPU usage drops below 20%.

    .warn(lambda: "usage_idle" < 20)
    .message('Hey, check your CPU')

Send alerts to Slack from a defined handler

The following setup sends an alert to the cpu topic with the message, “Hey, check your CPU”. A Slack handler is added that subscribes to the cpu topic and publishes all alert messages to Slack.

Create a TICKscript that publishes alert messages to a topic. The TICKscript below sends an critical alert message to the cpu topic any time idle CPU usage drops below 5%.

    .crit(lambda: "usage_idle" < 5)
    .message('Hey, check your CPU')

Add and enable the TICKscript:

kapacitor define cpu_alert -tick cpu_alert.tick
kapacitor enable cpu_alert

Create a handler file that subscribes to the cpu topic and uses the Slack event handler to send alerts to Slack. This handler using the non-default Slack handler, “critical-alerts”, which sends messages to the #critical-alerts channel in Slack.

id: slack-cpu-alert
topic: cpu
kind: slack
  workspace: 'alerts'
  icon-emoji: ':fire:'

Add the handler:

kapacitor define-topic-handler slack_cpu_handler.yaml

Using multiple Slack configurations

Kapacitor can use multiple Slack integrations, each identified by the value of the workspace config. The TICKscript below illustrates how multiple Slack integrations can be used.

In the kapacitor.conf above, there are two Slack configurations; one for alerts and the other for daily stats. The workspace configuration for each Slack configuration act as a unique identifiers.

The following TICKscript sends alerts to the alerts Slack workspace.

    .crit(lambda: "usage_idle" < 5)
    .message('Hey, I think the machine is on fire.')

Error rates are also being stored in the same InfluxDB instance and we want to send daily reports of 500 errors to the error-reports Slack workspace. The following TICKscript collects 500 error occurrences and publishes them to the 500-errors topic.

    .info(lambda: 'count' > 0)

Below is an aggregate handler that subscribes to the 500-errors topic, aggregates the number of 500 errors over a 24 hour period, then publishes an aggregate message to the 500-errors-24h topic.

id: 500-errors-24h
topic: 500-errors
kind: aggregate
  interval: 24h
  topic: 500-errors-24h
  message: '{{ .Count }} 500 errors last 24 hours.'

Last, but not least, a Slack handler that subscribes to the 500-errors-24h topic and publishes aggregated count messages to the error-reports Slack workspace:

id: slack-500-errors-daily
topic: 500-errors-24h
kind: slack
  workspace: error-reports

Was this page helpful?

Thank you for your feedback!

The future of Flux

Flux is going into maintenance mode. You can continue using it as you currently are without any changes to your code.

Flux is going into maintenance mode and will not be supported in InfluxDB 3.0. This was a decision based on the broad demand for SQL and the continued growth and adoption of InfluxQL. We are continuing to support Flux for users in 1.x and 2.x so you can continue using it with no changes to your code. If you are interested in transitioning to InfluxDB 3.0 and want to future-proof your code, we suggest using InfluxQL.

For information about the future of Flux, see the following: