I posted about this before but I still don’t have a solution - I have narrowed it down to what parameters are put in for script arguments in Graylog. If I put static information on the script Arguments Line, the script itself runs. What I need is the correct way to put in parameters based off of fields in the alert.
Has anyone passed in field data via Script arguments on an Alert Notification?
@tmacgbay
I’ve been banging at it, so far I’m at this point.
Error: Script invocation failed: [Cannot run program "/usr/share/graylog/scripts/alert_script.py" (in directory "/usr/share/graylog/scripts"): error=13, Permission denied]
Adjust the permissions, added the X bit on the file. made sure Graylog had access to it.
I’m using Docker which I not so good at it for troubleshooting.
Never used Script to send mail.
Bonus, I’m learning
This might have to do with Python and access the docker container, not sure thou
If I put static data for the fields it runs fine and sends the e-mail. But ${event.fields.event_time} and the like don’t work. I did change the script a bit since first post, I will put that in when I get to a computer.