Alerting custom fields

[asc-clo (Andreas Scholdan)]

Im trying to add a custom field to my event/alert

I added the template ${source.source_ip}
but it´s just empty, also I’m trying to add a link to the message where I need the index name that should be ${index} right? that is also not working.

Alerts

[Arie (Arie van den Heuvel)]

Is key should be Yes in the alert definition.

[asc-clo (Andreas Scholdan)]

I also tried that, the result the same:

[Arie (Arie van den Heuvel)]

Is the alert/event present within the timerange of the event definition in Filter & Aggregation?

[asc-clo (Andreas Scholdan)]

yes as you see here, there is plenty of alerts

[Arie (Arie van den Heuvel)]

Okay, looks all as it should be. Guess when the replay search button is hit, the messages appear in graylog search.

Is it that you do nog get the field in your email alert message?

[asc-clo (Andreas Scholdan)]

Yea the alerting part works fine see here:

[Arie (Arie van den Heuvel)]

Could you try it with another fieldname without an underscore in it. Could be that it fails on that.

[asc-clo (Andreas Scholdan)]

I found out if I change it to ${soruce}

I get this:

and now I’m able to grab ${source.source}

but how can I get more keys?

[Arie (Arie van den Heuvel)]

My guess is that it fails on the underscore if source.source works.

You could file a bug at their github space for this.

Graylog2/graylog2-server