Any macro with "NOTE: Escalation cancelled ..." in?

[troffasky]

Have a custom webhook sending a JSON event for trigger fire/clear. I have noticed that for an "escalation cancelled" event, this bit of the message does not appear in our payload and I cannot work out what macro it would be in. So it just looks like the original problem webhook being sent an hour later.
I have tried {ALERT.MESSAGE} but that is just the original message without the 'NOTE: Escalation canceled: trigger "<whatever>" disabled.' part.
Is there any macro I could use to infer that the trigger was disabled?
Zabbix 7.0

[cyber]

its in the code...

https://github.com/zabbix/zabbix/blob/release/7.0/src/zabbix_server/escalator/escalator.c#L968-L1066

[troffasky]

Well, it looks like it always uses the same medium as before.
I guess the problem is my webhook media type script:

var params = JSON.parse(value);

var req = new HttpRequest();
req.addHeader('Content-Type: application/json');

var payload = JSON.stringify({
    event_id: params.event_id,
    host_name: params.host_name,
    host_ip: params.host_ip,
    host_group: params.host_group,
    trigger_name: params.trigger_name,
    note: params.note,
    severity: params.severity,
    //status: params.event_status,
    trigger_state: params.trigger_state,
    trigger_status: params.trigger_status,
    timestamp: params.timestamp,
    //fullmessage: params.alert_message,
    tags: params.eventtags,
    event_value: params.event_value,
    event_ack: params.event_ack,
    event_ack_time: params.event_update_time,
    event_recovery_value: params.event_recovery_value,
    event_recovery_time: params.event_recovery_time
});

var resp = req.post(params.url, payload);

if (req.getStatus() !== 200) {
    throw 'Request failed with status ' + req.getStatus() + ': ' + resp;
}

return 'OK: ' + resp; zz0.7uy9y8kjb1ozz

trigger_state and trigger_status are {TRIGGER.STATE} and {TRIGGER.STATUS}, respectively. {TRIGGER.STATE} never resolves to anything.


An Escalation Cancelled message results in this payload:

{
  "event_id": "37689781",
  "host_name": "Test Host 5",
  "host_ip": "17.0.0.5",
  "host_group": "Miscellaneous Customers",
  "trigger_name": "\"ExampleSvc\" (Example Service) is not running",
  "note": "{EVENT.UPDATE.MESSAGE}",
  "severity": "Disaster",
  "trigger_state": "{TRIGGER.STATE}",
  "trigger_status": "PROBLEM",
  "timestamp": "17:09:00",
  "tags": "Application:Status, windows-service",
  "event_value": "1",
  "event_ack": "Yes",
  "event_ack_time": "{EVENT.UPDATE.TIME}",
  "event_recovery_value": "{EVENT.RECOVERY.VALUE}",
  "event_recovery_time": "{EVENT.RECOVERY.TIME}"
}

[not sure why ack time is blank, the event was acked!]

[troffasky]

"fullmessage" was {ALERT.MESSAGE} - this was the entire original message and didn't include the 'escalation cancelled' bit.