Alert Custom Message Template - Trying to use other Backlog message fields

[stephenoreilly]

Hello

I have created a Slack Notification with the following Custom Message Template:
Title: {event_definition_title} *Timestamp:* {event.timestamp}
Message ID: {event.id} {if backlog}
Last messages accounting for this alert:
{foreach backlog message} *Timestamp:* {timestamp}
Message: {message} {end}
${end}

My issue is the “timestamp” value under Backlog does not appear in my notification.

Looking at this page: Alerts — Graylog 4.0.0 documentation,
I have tried using all of the Backlog variables but the only one that appears to work is “message”.

Do I just have a syntax error in my Custom Message Template or has anyone else experienced similar issues?

I am running Graylog v4.0.5+d95b909.

Any help would be greatly appreciated.

Regards
StephenO

[aaronsachs]

This will probably sound dumb, but is this the actual text of your template?

Title: {event_definition_title} *Timestamp:* {event.timestamp}
Message ID: {event.id} {if backlog}
Last messages accounting for this alert:
{foreach backlog message} *Timestamp:* {timestamp}
Message: {message} {end}
${end}

Because if so, alllllllllll of those attributes need to be prefixed with $. It should instead look like:

Title: ${event_definition_title} *Timestamp:* ${event.timestamp}
Message ID: ${event.id} ${if backlog}
Last messages accounting for this alert:
${foreach backlog message} *Timestamp:* ${timestamp}
Message: ${message} ${end}
${end}

[stephenoreilly]

Hi Aaron
Many thanks for the reply.
The attributes in my template are prefixed with “$” - I think they got remove when I pasted it this article.
I uploaded a screenshot.
Cheers
StephenO

[shoothub]

If you want to use timestamp field use {$message.timestamp}
If you want to use user field (for example: src_ip) use {$message.fields.src_ip}

[stephenoreilly]

Hi shoothub
Thank you - that sorted the issue for me.
Many thanks
StephenO