Slack, Telegram and webhook alerts in Zabbix

You’ll build a custom webhook called Lab webhook that posts JSON to a small Python receiver on web01 (192.168.56.81, port 8088). Zabbix server on zbx01 (192.168.56.80) runs the script, so the traffic goes from zbx01 to web01, which is the same direction as a real call to Telegram or Slack, only shorter.

1Write the test receiver on web01

The receiver prints every JSON body it gets, with the time, the sender’s IP and a lab token header, and answers {"ok":true}. It uses only the Python standard library, which Ubuntu Server already has.

Paste this whole block on web01:

sudo mkdir -p /opt/zbx-hook
sudo tee /opt/zbx-hook/zbx_receiver.py >/dev/null <<'EOF'
#!/usr/bin/env python3
# Tiny test receiver for Zabbix webhooks (lab only, no auth)
import json, sys
from datetime import datetime
from http.server import BaseHTTPRequestHandler, HTTPServer

PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 8088

class Hook(BaseHTTPRequestHandler):
    def do_POST(self):
        size = int(self.headers.get('Content-Length', 0))
        body = self.rfile.read(size).decode('utf-8', 'replace')
        try:
            data = json.loads(body)
        except ValueError:
            self.send_response(400); self.end_headers()
            self.wfile.write(b'{"ok":false,"error":"invalid JSON"}')
            return
        now = datetime.now().strftime('%H:%M:%S')
        print(f"{now} from {self.client_address[0]} token={self.headers.get('X-Lab-Token')}")
        print(json.dumps(data, indent=2), flush=True)
        self.send_response(200)
        self.send_header('Content-Type', 'application/json')
        self.end_headers()
        self.wfile.write(b'{"ok":true}')

    def log_message(self, *args):
        pass

print(f"Listening on 0.0.0.0:{PORT}", flush=True)
HTTPServer(('0.0.0.0', PORT), Hook).serve_forever()
EOF
sudo ufw allow from 192.168.56.80 to any port 8088 proto tcp
python3 /opt/zbx-hook/zbx_receiver.py 8088

You should see:

Rule added
Listening on 0.0.0.0:8088

Leave this SSH session open, because the receiver runs in the foreground and you’ll watch messages land here. The ufw rule lets only zbx01 reach port 8088, the same way you would allow only your Zabbix server to reach a real internal API.

✅ Checkpoint: web01 shows “Listening on 0.0.0.0:8088” and ufw has a rule for 8088 from 192.168.56.80.

2Test the receiver from zbx01 with curl

Before Zabbix is involved, prove the network path works. If this fails, no webhook setting will help.

Run this on zbx01:

curl -sS -X POST http://192.168.56.81:8088/zabbix \
  -H 'Content-Type: application/json' -H 'X-Lab-Token: lab-7d41' \
  -d '{"source":"curl","subject":"hello from zbx01"}'

You should see this on zbx01:

{"ok":true}

And this in the web01 session:

14:20:11 from 192.168.56.80 token=lab-7d41
{
  "source": "curl",
  "subject": "hello from zbx01"
}

The receiver logs the source address 192.168.56.80, which tells you the request came from zbx01 over the host-only network. If curl hangs instead, check the ufw rule on web01 and that you used the 192.168.56.81 address.

✅ Checkpoint: curl on zbx01 prints {“ok”:true} and web01 prints the JSON with token=lab-7d41.

3Create the Lab webhook media type

In the frontend go to Alerts > Media types and click Create media type. Set Name Lab webhook and Type Webhook. In Parameters add these rows (Name on the left, Value on the right):

Paste this into Script, set Timeout to 10s, leave Process tags off and click Add.

Paste this whole block into the Script field:

var params = JSON.parse(value);
try {
    if (!params.url) {
        throw 'parameter "url" is empty';
    }
    var req = new HttpRequest();
    req.addHeader('Content-Type: application/json');
    req.addHeader('X-Lab-Token: ' + params.token);
    if (params.http_proxy) {
        req.setProxy(params.http_proxy);
    }
    var body = JSON.stringify({
        source: 'zabbix',
        event_id: params.event_id,
        status: params.status,
        severity: params.severity,
        host: params.host,
        send_to: params.send_to,
        subject: params.subject,
        message: params.message.trim()
    });
    Zabbix.log(4, '[Lab webhook] sending: ' + body);
    var resp = req.post(params.url, body);
    if (req.getStatus() !== 200) {
        throw 'receiver returned HTTP ' + req.getStatus() + ': ' + resp;
    }
    return 'OK';
}
catch (error) {
    Zabbix.log(3, '[Lab webhook] notification failed: ' + error);
    throw 'Sending failed: ' + error;
}

Every failure path ends in a throw with a readable sentence, which is what Zabbix will show in the Action log. Level 3 in Zabbix.log is a warning and level 4 is debug, so the “sending” line only appears when you raise the alerter’s log level.

✅ Checkpoint: Alerts > Media types lists “Lab webhook” with type Webhook and status Enabled.

4Add message templates

Open Lab webhook again and go to the Message templates tab. Click Add three times and choose Problem, Problem recovery and Problem update, keeping the default text Zabbix offers. Without a template for the event type, an action that uses this media type has no subject or message to send.

Click Update.

Problem             Subject: Problem: {EVENT.NAME}
Problem recovery    Subject: Resolved in {EVENT.DURATION}: {EVENT.NAME}
Problem update      Subject: Updated problem in {EVENT.AGE}: {EVENT.NAME}

✅ Checkpoint: The Message templates tab of Lab webhook lists Problem, Problem recovery and Problem update.

5Test the media type from the frontend

In the Media types list click Test in the Lab webhook row. The dialog shows every parameter with its value; the macros are not resolved here because there’s no real event, so type noc-hyd for send_to and leave the others. Click Test.

You should see this in the web01 session:

14:24:37 from 192.168.56.80 token=lab-7d41
{
  "source": "zabbix",
  "event_id": "{EVENT.ID}",
  "status": "{EVENT.STATUS}",
  "severity": "{EVENT.SEVERITY}",
  "host": "{HOST.NAME}",
  "send_to": "noc-hyd",
  "subject": "{ALERT.SUBJECT}",
  "message": "{ALERT.MESSAGE}"
}

The frontend shows Media type test successful. with Response OK (Response type: String). The literal macros in the receiver are expected in a test, and they prove each parameter reached the script. Click Open log in the dialog to see the Zabbix.log lines from your script, which is the fastest way to debug a new webhook.

✅ Checkpoint: The test dialog says “Media type test successful.” and web01 printed a JSON body with send_to “noc-hyd”.

6Give the Admin user a Lab webhook media

Go to Users > Users, open Admin, Media tab, Add. Choose Type Lab webhook, Send to noc-hyd, keep When active 1-7,00:00-24:00, and under Use if severity untick Not classified and Information. Click Add, then Update.

The Email media from Lesson 16 stays as it is. Send to can be anything your script understands; for Telegram it’s the chat ID and for Slack the channel.

✅ Checkpoint: Admin has two media rows: Email and Lab webhook (Warning and above).

7Create a trigger action for web01 problems

Go to Alerts > Actions > Trigger actions and click Create action. Name it Webhook to NOC (Lab/Web). On the Action tab add two conditions: Host group equals Lab/Web and Trigger severity is greater than or equals Warning.

On the Operations tab add an operation: Send to users Admin, Send to media type Lab webhook. Under Recovery operations and Update operations add Notify all involved. Click Add.

Choosing the media type in the operation matters. If you leave it at “All”, Admin also gets the email from Lesson 16 for these problems, which is fine at home and doubles the noise at work.

✅ Checkpoint: Trigger actions lists “Webhook to NOC (Lab/Web)” as Enabled with two conditions.

8Fire a real problem and watch it arrive

Stop Nginx on web01 from a second SSH session. The Nginx trigger from Lesson 8 fires within a minute or two, depending on your item interval. If you skipped that lesson, any trigger on web01 with Warning or higher severity works.

Run this in a second session on web01:

sudo systemctl stop nginx

The receiver session prints this (your event ID and times will differ):

14:31:52 from 192.168.56.80 token=lab-7d41
{
  "source": "zabbix",
  "event_id": "2417",
  "status": "PROBLEM",
  "severity": "High",
  "host": "web01",
  "send_to": "noc-hyd",
  "subject": "Problem: Nginx is down on web01",
  "message": "Problem started at 14:31:46 on 2026.11.08\nProblem name: Nginx is down on web01\nHost: web01\nSeverity: High\nOperational data: 0\nOriginal problem ID: 2417"
}

Now the macros are real values: the event ID, status, severity and host name. Start Nginx again with sudo systemctl start nginx and within a minute a second body arrives with status RESOLVED and a subject starting “Resolved in”.

✅ Checkpoint: The receiver printed a PROBLEM body for web01 and, after Nginx started, a RESOLVED body with the same event_id.

9Read the result in the Action log

Open Reports > Action log and filter on the last hour. You should see your two webhook messages with status Sent, next to the emails from Lesson 16 if those actions also matched.

This page is your first stop whenever someone says “I didn’t get the alert”. It tells you whether an action matched at all, which media type was used, and the exact error text if the script threw.

✅ Checkpoint: Reports > Action log shows two Lab webhook rows for web01 with status Sent.

10Optional: switch on Telegram

If you have Telegram, open a chat with @BotFather, send /newbot, choose a name and a username ending in “bot”, and copy the token it gives you. Then open a chat with your new bot and send it /start, because a bot can’t start a conversation with you. Find your chat ID with the Bot API from zbx01 (replace the token):

Run this on zbx01:

TOKEN='1234567890:AAH-your-bot-token'
curl -s "https://api.telegram.org/bot$TOKEN/getUpdates" | python3 -m json.tool | grep -A2 '"chat"'

You should see this (with your own chat ID and name):

                "chat": {
                    "id": 512345678,
                    "first_name": "Ravi",

In Alerts > Media types open the built-in Telegram media type, set api_token to your token and api_parse_mode to markdown, tick Enabled and click Update. Click Test, put your chat ID in api_chat_id and you get a message from your bot. For a group, add the bot to the group and use the group’s negative ID (supergroups start with -100); for a topic in a supergroup, 8.0 accepts <group_id>:<topic_id>.

✅ Checkpoint: Your phone shows the Zabbix test message from your bot, or you skipped this optional step.