Baike.dev
Log in
Back to tool/Back to issues
#14451·openobserve

Bug: Email alert template incorrectly escapes single quotes and backslashes

Author: rohan-sirohi-spraxaCreated Sep 11, 2026Updated Sep 16, 2026
Labels☢️ Bug

Bug Description

When using a custom Email Raw Payload template in OpenObserve Enterprise v1.0.0, string values from alert results are rendered with additional escape characters.

For example, the original ingested value:

TEST 'ABC' XYZ

is rendered in the email as:

TEST \'ABC\' XYZ

Similarly, the original stack trace:

TypeError: Cannot read 'properties' of undefined

is rendered as:

TypeError: Cannot read \'properties\' of undefined

This occurs even when the Alert Row Template is completely cleared, confirming that the issue is also reproducible when stream fields are substituted directly into the email notification template.

Additional Verification

The issue was initially investigated with a custom Alert Row Template. However, after completely clearing the Row Template and using the stream fields directly in the email Raw Payload template, the same escaping behavior still occurs.

Therefore, the issue is reproducible without an Alert Row Template.

The ingested data itself is correct; the additional escape characters are only observed in the generated email notification.

Impact

This affects email alert readability and can make messages and stack traces appear different from the original log data. It is particularly noticeable for error messages, stack traces, URLs, and other fields containing quotes or backslashes.

Request

Please investigate the email alert template variable rendering and fix the escaping behavior so that string values in custom email templates are rendered correctly while preserving the original ingested data.

Priority

P2 - Medium

Severity

Minor

Related Story/Issue

No response

Is this a regression?

No

Steps to Reproduce (Optional)

  1. Create a log stream containing an event such as:
json
{
  "_timestamp": 1789138297077695,
  "utc_date": "2026-09-11T14:51:37.077695Z",
  "severity": "Error",
  "application_name": "TEST_FRONTEND",
  "message": "TEST 'ABC' XYZ",
  "stack_trace": "TypeError: Cannot read 'properties' of undefined"
}

  1. Create a real-time alert for the stream.

  2. Configure an email notification using a Raw Payload template, for example:

xml
<html>
<body>

<h2>{severity}: {application_name}</h2>

<table cellpadding="5" cellspacing="0">
<tr><td><b>Application</b></td><td>{application_name}</td></tr>
<tr><td><b>Machine</b></td><td>{machine_name}</td></tr>
<tr><td><b>Module</b></td><td>{module_name}</td></tr>
<tr><td><b>User</b></td><td>{user}</td></tr>
<tr><td><b>Remote Host</b></td><td>{remote_host}</td></tr>
<tr><td><b>URL</b></td><td>{absolute_url}</td></tr>
<tr><td><b>Time (UTC)</b></td><td>{utc_date}</td></tr>
</table>

<hr>

<h3>Message</h3>
<div>{message}</div>

<h3>Stack Trace</h3>
<div style="font-family: monospace;">
{stack_trace}
</div>

</body>
</html>

  1. Ensure the Alert Row Template is empty.

  2. Trigger the alert.

  3. Check the received email.

Actual Result

The email contains additional escape characters:

Message
TEST \'ABC\' XYZ

and:

Stack Trace
TypeError: Cannot read \'properties\' of undefined
Image

Expected Result

The email should preserve the original string values:

Message
TEST 'ABC' XYZ

and:

Stack Trace
TypeError: Cannot read 'properties' of undefined

No additional \ characters should be introduced during template rendering.

Environment Details

yaml
OpenObserve: Enterprise v1.0.0
Deployment: Self-hosted
Architecture: x86_64
Alert Type: Real-time
Stream Type: Logs
Notification: Email
Template Type: Raw Payload
Alert Row Template: Empty

Which OpenObserve Functionalities Are Affected?

  • Home & Login
  • Logs / Metrics / Traces
  • Dashboards
  • Alerts
  • Streams, Pipelines & Functions
  • Ingestion
  • Real User Monitoring (RUM)
  • Reports
  • IAM & Management
  • UI / Styling
  • Unknown / Other

Source: openobserve/openobserve

View original on GitHubView discussion on GitHub