# Alert Scripts - Script Arguments - Field Format **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** alert, script\ **Created:** [October 5, 2022, 7:55pm UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054 "2022-10-05T19:55:13Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [October 5, 2022, 7:55pm UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054/1 "2022-10-05T19:55:13Z")
I posted about this before but I still don’t have a solution - I have narrowed it down to what parameters are put in for script arguments in Graylog. If I put static information on the script Arguments Line, the script itself runs. What I need is the correct way to put in parameters based off of fields in the alert. Has anyone passed in field data via Script arguments on an Alert Notification? The metadata on the Script Argument Line is: ` ` If I put in static information like: `"tmacgbay" "Batcave-PC2" "Robin@batcave.com" "10-5-22"` then the outcome is as expected where [Robin@batcave.com](mailto:Robin@batcave.com) will receive an e-mail I have tried the following that would pull data from the alerted on message ```auto "${event.fields.winlog_event_data_TargetUserName}" "${event.fields.winlog_event_data_TargetDomainName}" "${event.fields.user_email}" "${event.fields.event_created}" ``` Or having it look more like the documentation (taking out the `.fields.`) ```auto "${event.winlog_event_data_TargetUserName}" "${event.winlog_event_data_TargetDomainName}" "${event.user_email}" "${event.event_created}" ``` I have also tried removing the quotes… If you have an example of using Alerts Scripting and passing parameters, can you post it here? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [October 5, 2022, 10:25pm UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054/2 "2022-10-05T22:25:37Z")
Hey, > [@tmacgbay](#): > > Has anyone passed in field data via Script arguments on an Alert Notification? I just started my GL operation docker server back up. I think I can test this out.` ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [October 6, 2022, 1:45am UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054/3 "2022-10-06T01:45:24Z")
Where do I send the coffee? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [October 6, 2022, 2:27am UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054/4 "2022-10-06T02:27:15Z")
Ok so I have a slight problem, I’m using Docker Enterprise image and through in the Default example of Graylog alert script from the doc’s. Jumping through hurdles right now. Permission issues, unable to locate script issues. TBH it is a good leaning lesson 😆 ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [October 7, 2022, 10:27pm UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054/5 "2022-10-07T22:27:25Z")
@tmacgbay I’ve been banging at it, so far I’m at this point. ```auto Error: Script invocation failed: [Cannot run program "/usr/share/graylog/scripts/alert_script.py" (in directory "/usr/share/graylog/scripts"): error=13, Permission denied] ``` Adjust the permissions, added the X bit on the file. made sure Graylog had access to it. 1. I’m using Docker which I not so good at it for troubleshooting. 2. Never used Script to send mail. Bonus, I’m learning 👍 This might have to do with Python and access the docker container, not sure thou ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [October 8, 2022, 12:02am UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054/6 "2022-10-08T00:02:35Z")
If I put static data for the fields it runs fine and sends the e-mail. But ${event.fields.event\_time} and the like don’t work. I did change the script a bit since first post, I will put that in when I get to a computer. Hope you Friday night is fun! ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [October 8, 2022, 12:12am UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054/7 "2022-10-08T00:12:39Z")
> [@tmacgbay](#): > > Hope you Friday night is fun! thanks Tad, yeah I cant wait to get home tonight. to much is going on here and I’m tired of looking at server lights and little black boxes 😆 ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [October 22, 2022, 12:12am UTC](https://community.graylog.org/t/alert-scripts-script-arguments-field-format/26054/8 "2022-10-22T00:12:46Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.