I’m trying to set up an alert and get the IP address from the message, but I cant get the formatting right. --- [Event Definition] --------------------------- Title: ${event_definition_title} Description: ${event_definition_description} Type: ${event_definition_type} --- [Event] ------…

If you want to use user field (for example: IpAddress) use {$message.fields.IpAddress} : ${foreach backlog message}${message.fields.IpAddress}${end} You need to to use cycle foreach for backlog if you want to use message fields. Also don’t forgot, that you have to setup number of backlog to 1: i…

[image] shoothub: {$message.fields.IpAddress} : ${foreach backlog message}${message.fields.IpAddress}${end} Sadly, that didnt work.

It should definitely work, please: Remove incorrect formated line: {$message.fields.IpAddress} : replace it only with label e.g.: Source IP: Check your Message backlog setting in event definition. And how about message field, it’s printed correctly? I mean after line Last messages accounting for t…

Perhaps this can help [image] Notifications from windows Graylog Central (peer support) notifications from windows Hey. I want to receive notifications from my windows log file. I have a template: {event.message}</b>{if event.timerange_start} Timerange: {event.timerang…

[image] shoothub: ${foreach backlog message}${message.fields.IpAddress}${end} [capture1] [Capture] and the result (source IP is blank): — [Event Definition] --------------------------- Title: Password/Account Spray Description: Type: aggregation-v1 — [Event] -------------…

How about full message below line — [ Backlog] ------ Is there a full message, or is also empty?

Yes, there is a full message. The bold text is what I want to capture — [Backlog] ------------------------------------ Last messages accounting for this alert: {index=graylog_67, message=An account failed to log on. Subject: Security ID: S-1-0-0 Account Name: - Account Do…

IP ${foreach backlog message}${message.fields.IpAddress}${end} If change to this, without foreach part, it works or not? IP ${message.fields.IpAddress}

Doesnt, tried that first already.

You highlighted little odd line, it’s from message field, but it can only work in email template if IP address is only from extracted field. Please also check that you don’t use parameters in event definition…

Alert email format

Graylog Central (peer support)

shoothub (Shoothub) September 3, 2020, 6:43am 4

It should definitely work, please:

Remove incorrect formated line: {$message.fields.IpAddress} : replace it only with label e.g.: Source IP:
Check your Message backlog setting in event definition.
And how about message field, it’s printed correctly? I mean after line Last messages accounting for this alert:

Topic		Replies	Views
Extracting Message Parameters to Alert Emails Graylog Central (peer support)	6	1386	May 22, 2021
Email Variabls to display HOSTNAME, IP, PROCESS, etc Graylog Central (peer support)	9	2246	July 2, 2019
Notification email backlog blank despite enabled Graylog Central (peer support)	3	2487	September 14, 2020
Mikrotik Log and email notification alert Graylog Central (peer support) alert	3	2035	January 18, 2022
${message.message} not working in the alert template Graylog Central (peer support)	17	6278	October 2, 2018

Alert email format

Related topics