Add the event source to the subject of an email notification

[M_G]

I would like to know if it is possible to add the source of an event to the subject of an email alert notification.

I’ve looked into the variables:
${event.source} : Displays the name of the Graylog server itself
${message.source} : Gives no result (In the body or the subject).

I see we have the ability to add Custom Fields with version 3.1.1, but I was only able to find a brief documentation about this functionality.

I’m not the first one with this question, but the other threat is closed without any replies:

How to receive the notification with the source info

Hi All I’m newbie for Graylog configuration. I’m trying to set E-mail alert using Graylog. I’ve set the stream, alert, notification and I also got the e-mail notification when it hit the condition. But I can not see the which source has the issue. The below E-mail body configuration is default setting. How can I adjust the below contents to see which host or ip address has an issue ? Both “Message: {message.message}" and "Source: {message.source}” are not working. ########## Alert Descr…

[Ponet (Jesse Hills)]

I do not believe it’s possible to put the message source into the subject line of the alert however, you will be able to put that information into the body of the email.

Please see the documentation for more information on this:
https://docs.graylog.org/en/3.1/pages/streams/alerts.html#email-alert-notification

[tmacgbay]

If you embed a foreach into the subject line, you can get source in there…

${foreach backlog message}${message.fields.source}${end}

Its messy though if your alert caught multiple instances.

[jan (Jan Doberstein)]

I would like to know if it is possible to add the source of an event to the subject of an email alert notification.

No that is not possible.

But we already have a feature request for that: Use message fields in Email subject · Issue #6603 · Graylog2/graylog2-server · GitHub

[M_G]

This doesn’t work unfortunately.

[M_G]

Thanks. Would be nice if they could implement this feature

[shoothub]

It works. If you want source field in subject, you need to use {$message.source}:

${foreach backlog message}${message.source}${end}

If you want to use user field (for example: src_ip) use {$message.fields.src_ip} as @tmacgbay suggested:
${foreach backlog message}${message.fields.src_ip}${end}

For example I use this subject after somebody connect to switch:

User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}

If didn’t work for you, check if you have setup Message backlog to 1 on Notification tab of your Event Definition.

[M_G]

@shoothub

${foreach backlog message}${message.fields.src_ip}${end}

Yes! This one works
Thanks!