Alert: full_message is without linebreaks

Graylog Central (peer support)
1

1. Describe your incident:
The full_message like this:

image
image1188×484 21 KB

is defined in Notification ‘Email HTML Body’ like this:

	<tr><td>Full Message</td><td></td></tr>
	<tr><td colspan="2">${message.fields.full_message}</td></tr>
	<tr><td colspan="2">------------------------------------------------------</td></tr>
	<tr><td></td><td></td></tr>

That results in following:

image
image1160×692 57.1 KB

Why are there no linebreaks anymore?

2. Describe your environment:

  • Graylog Open 6.1.2

3. What steps have you already taken to try and solve the problem?
No idea how to fix that.

4. How can the community help?
What to do, so that the full_message is shown in the email notification with all the linebreaks?

2

If you look at the event in the all events stream on the search page how does that field look in there, does it have line breaks?

3

The full_message is well formatted on the search page (see the first screenshot of my request. So it seems that the linebreaks are removed during mapping into the Email HTML body.

4

So i dont mean the original message, when the event fires a new message is generated in the “all messages” stream, and all the custom fields your extract from the message are stored as a subfield. My guess is the loss of formstting occurs at that step, but i wanted to confirm.

5

So than that is a bug?
Or can I use it somehow different to not lose the formatting?

6

The issue of missing line breaks in your email notification likely stems from how the HTML email template interprets the full_message field. When you use ${message.fields.full_message}, the data is inserted as a single unformatted string, and the line breaks (e.g., \n) from the original log are ignored in the HTML rendering. HTML requires explicit tags for line breaks.

You can solve this by replacing the line breaks in the full_message field with HTML <br> tags before rendering the notification.

I was able to replicate the issue and the fix in a lab environment by using the following:

image
image802×170 9.55 KB

The ?replace("\n", "<br>") in the template replaces newline characters (\n) in the full_message field with <br> tags, which are recognized by HTML as line breaks.This ensures that the message retains its original line-by-line format when rendered in the email body.

Let me know if this works for you. :slight_smile:

7

Unfortunately not:

image
image1114×785 124 KB

8

Is there a way to solve that problem with the missing line breaks?
Do I use the function in a wrong way?

9

I wish everybody happy New Year.
Who can help me with this described issue?