Add the event source to the subject of an email notification

Graylog Central (peer support)
7

It works. If you want source field in subject, you need to use {$message.source}:

${foreach backlog message}${message.source}${end}

If you want to use user field (for example: src_ip) use {$message.fields.src_ip} as @tmacgbay suggested:
${foreach backlog message}${message.fields.src_ip}${end}

For example I use this subject after somebody connect to switch:

User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}

If didn’t work for you, check if you have setup Message backlog to 1 on Notification tab of your Event Definition.

1 Like