Is it possible to have dynamic content in custom alerts? alertd/snmp

That's a very interesting question - i haven't done it but the alert uses regex to detect the correct log so if you had 'Interface (.*?): link is down' then it may appear as $1

eg

alert ALERT_NAME "Interface (.*?): link is down" {
email toaddress="myemail@somewhere.com"
fromaddress="root"
body="Link $1 is down"
}

Give it a try and let me know