Kibana parsing error

[TinyTyno]

I am trying to send an alert from Kibana to Keep but i got this error when the alert comes in

Raw Trace Alert

Note

{
"webhook_body": {
"rule_info": "{"params":{"criteria":[{"comparator":">","metrics":[{"name":"A","field":"system.cpu.total.norm.pct","aggType":"avg"}],"threshold":[0.9],"timeSize":1,"timeUnit":"m"}],"alertOnNoData":false,"alertOnGroupDisappear":false,"searchConfiguration":{"query":{"query":"","language":"kuery"},"index":"metrics-"}},"id":"9bc34569-8cb0-437d-aba9-f8dbc111fa14","name":"CPU Usage > 90%","type":"observability.rules.custom_threshold","spaceId":"default","tags":[]}",
"alert_info": "{"id":"","uuid":"9ad9adc6-5166-41cf-8786-645f6314d0d2","actionGroup":"custom_threshold.fired","actionGroupName":"Alert","flapping":false}",
"context_info": "{"alertDetailsUrl":"/app/observability/alerts/9ad9adc6-5166-41cf-8786-645f6314d0d2","reason":"Average system.cpu.total.norm.pct is 99.9%, above the threshold of 90%. (duration: 1 min, data view: metrics-*)","timestamp":"2025-10-22T08:10:46.310Z","value":["99.9%"],"viewInAppUrl":"/app/r?l=DISCOVER_APP_LOCATOR&v=9.1.4&lz=N4IgJghgLhBqCWBTA7gSTCAXCAtoqATvAMYDOAtAFQgA0IU8eAShAHYDmiWoAZgQPY4sIAEwAGEQFZyARjHkRIgCpiA7JkljMAFgBsAOgDMcgFq16%2FYa37IQAXzoBHAK6ICAT24gXbz9nMANmzszhCcwgDWrh72dDzwAVBupFgA2gC6dkA%3D%3D","tags":[]}"
}
}

Note

Error processing event, contact Keep team for more information

[talboren]

Hey @TinyTyno,

Is it in the managed platform or on a local hosted Keep? Can you send the backend logs?

[TinyTyno]

Hi @talboren,

It is in the managed platform which i am not able to send you the backend logs. The following picture is the exact reference i see