# using wildcards in alarms
**URL:** https://community.netdata.cloud/t/using-wildcards-in-alarms/5723
**Category:** Help
**Tags:** configuration, agent, alerts
**Created:** [August 23, 2024, 12:22am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723 "2024-08-23T00:22:08Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@enkaskal](https://community.netdata.cloud/u/enkaskal)
#### Post date: [August 23, 2024, 12:22am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/1 "2024-08-23T00:22:08Z")
I have the following alarm that’s working:
```auto
alarm: vault_sealed
on: statsd_vault.core.unsealed.vault-cluster-abcde123_gauge
lookup: average -5s
units: %
every: 1s
warn: $this > 0
crit: $this > 0
summary: vault is sealed! MANUAL INTERVENTION REQUIRED!
info: contact vault admins to perform the unsealing ceremony
to: sysadmin
```
(N.B. the vault is unsealed, so this will always trigger, and am just using this to troubleshoot the context)
however, I’d like to use a wildcard in the context statement to make it more generic. something like,
```auto
alarm: vault_sealed
on: statsd_vault.core.unsealed.*
lookup: average -5s
units: %
every: 1s
warn: $this > 0
crit: $this > 0
summary: vault is sealed! MANUAL INTERVENTION REQUIRED!
info: contact vault admins to perform the unsealing ceremony
to: sysadmin
```
I’ve searched the documentation and found the simple patterns, but either I’m not applying it correctly or it’s not supported for alarms/templates?
Any thoughts or ideas?
TIA 🙂
---
### Author:  [@ilyam8](https://community.netdata.cloud/u/ilyam8)
#### Post date: [August 23, 2024, 8:06am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/2 "2024-08-23T08:06:33Z")
Hey, @enkaskal.
```auto
alarm: vault_sealed
on: statsd_vault.core.unsealed.*
```
- `on` is applied to the id of the chart when using `alarm`
- `on` is applied to the context of charts when using `template`.
Do “statsd\_vault.core.unsealed.\*” charts have the same context?
This is where you can find it:
---
### Author:  [@enkaskal](https://community.netdata.cloud/u/enkaskal)
#### Post date: [August 23, 2024, 9:42am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/3 "2024-08-23T09:42:21Z")
Hi ilyam8, thanks for the reply 🙂
Here is the chart of the actual instance I’m testing:
This works and generates an alarm in the dashboard:
```auto
alarm: vault_sealed
on: statsd_vault.core.unsealed.vault-cluster-bb4c27a6_gauge
lookup: average -5s
units: %
every: 1s
warn: $this > 0
crit: $this > 0
summary: vault is sealed! MANUAL INTERVENTION REQUIRED!
info: contact vault admins to perform the unsealing ceremony
to: sysadmin
```
as well as a log of:
```auto
Aug 23 02:37:15 netdata netdata[143588]: ALERT 'vault_sealed' of instance 'statsd_vault.core.unsealed.vault-cluster-bb4c27a6_gauge' on node 'vault', transitioned from UNINITIALIZED to CRITICAL
```
as does this:
```auto
template: vault_sealed
on: statsd_vault.core.unsealed.vault-cluster-bb4c27a6_gauge
lookup: average -5s
units: %
every: 1s
warn: $this > 0
crit: $this > 0
summary: vault is sealed! MANUAL INTERVENTION REQUIRED!
info: contact vault admins to perform the unsealing ceremony
to: sysadmin
```
However, neither of these work:
```auto
template: vault_sealed
on: statsd_vault.core.unsealed.*
lookup: average -5s
units: %
every: 1s
warn: $this > 0
crit: $this > 0
summary: vault is sealed! MANUAL INTERVENTION REQUIRED!
info: contact vault admins to perform the unsealing ceremony
to: sysadmin
```
```auto
alarm: vault_sealed
on: statsd_vault.core.unsealed.*
lookup: average -5s
units: %
every: 1s
warn: $this > 0
crit: $this > 0
summary: vault is sealed! MANUAL INTERVENTION REQUIRED!
info: contact vault admins to perform the unsealing ceremony
to: sysadmin
```
and just for completeness I tried these too:
```auto
alarm: vault_sealed
on: vault.core.unsealed.*
lookup: average -5s
units: %
every: 1s
warn: $this > 0
crit: $this > 0
summary: vault is sealed! MANUAL INTERVENTION REQUIRED!
info: contact vault admins to perform the unsealing ceremony
to: sysadmin
```
```auto
template: vault_sealed
on: vault.core.unsealed.*
lookup: average -5s
units: %
every: 1s
warn: $this > 0
crit: $this > 0
summary: vault is sealed! MANUAL INTERVENTION REQUIRED!
info: contact vault admins to perform the unsealing ceremony
to: sysadmin
```
but, of course, they didn’t work either.
---
### Author:  [@ilyam8](https://community.netdata.cloud/u/ilyam8)
#### Post date: [August 24, 2024, 3:56pm UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/4 "2024-08-24T15:56:01Z")
@enkaskal [on](https://learn.netdata.cloud/docs/alerts-&-notifications/alert-configuration-reference#alert-line-on) doesn’t support wildcards, it must be an exact value. We need to extend Netdata’s Statsd protocol to support tags (labels).
---
### Author:  [@enkaskal](https://community.netdata.cloud/u/enkaskal)
#### Post date: [August 25, 2024, 3:39am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/5 "2024-08-25T03:39:05Z")
@ilyam8 gotcha; thank you!
did you want me to file a feature request somewhere or vote for it somewhere?
---
### Author:  [@ilyam8](https://community.netdata.cloud/u/ilyam8)
#### Post date: [August 26, 2024, 8:40am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/6 "2024-08-26T08:40:15Z")
> did you want me to file a feature request
Yes, please.
---
### Author:  [@enkaskal](https://community.netdata.cloud/u/enkaskal)
#### Post date: [August 26, 2024, 8:52am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/7 "2024-08-26T08:52:24Z")
@ilyam8 np 🙂 where at? somewhere here in the forums or on github? (or both?)
EDIT: grammar
---
### Author:  [@ilyam8](https://community.netdata.cloud/u/ilyam8)
#### Post date: [August 26, 2024, 9:23am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/8 "2024-08-26T09:23:32Z")
[GitHub Feature Request](https://github.com/netdata/netdata/issues/new?assignees=&labels=feature+request%2Cneeds+triage&projects=&template=FEAT_REQUEST.yml&title=%5BFeat%5D%3A+)
---
### Author:  [@enkaskal](https://community.netdata.cloud/u/enkaskal)
#### Post date: [August 26, 2024, 9:46am UTC](https://community.netdata.cloud/t/using-wildcards-in-alarms/5723/9 "2024-08-26T09:46:22Z")
filed and @'d you on github: [[Feat]: extend Netdata’s Statsd protocol to support tags (labels). · Issue #18412 · netdata/netdata · GitHub](https://github.com/netdata/netdata/issues/18412)
thanks for the assistance; i really appreciate it! 😃