Hello @tmacgbay,
im using enterprise since 1 week and didnt notice the new script callback function 
after some try and error i got the following, based on the script from documentation:
(still on python2, so i need to add “print” as function to use it)
#!/usr/bin/env python2
from __future__ import print_function
import json
import sys
import subprocess
# Main function
if __name__ == "__main__":
# Print out all input arguments.
action = sys.argv[1]
f = open("/tmp/testnotification.log", "a")
f.write("Action: " + action + "\n")
for i in sys.argv[2:]:
f.write("Arguments: " + i + "\n")
f.close
# Turn stdin.readlines() array into a string
std_in_string = ''.join(sys.stdin.readlines())
# Load JSON
event_data = json.loads(std_in_string)
# Extract Message Backlog field from JSON.
f = open("/tmp/testnotification.log", "a")
f.write("\nBacklog:\n")
arg_string=""
for message in event_data["backlog"]:
try:
f.write("custom once to: " + message["fields"]["to"] + "\n")
my_to = message["fields"]["to"]
arg_string+='-t \'' + my_to + '\' '
except:
pass
try:
f.write("custom once from: " + message["fields"]["from"] + "\n")
my_from = message["fields"]["from"]
arg_string+='-f \'' + my_from + '\' '
except:
pass
try:
f.write("custom once MailAction: " + message["fields"]["MailAction"] + "\n")
my_mailaction = message["fields"]["MailAction"]
arg_string+='-m \'' + my_mailaction + '\' '
except:
pass
try:
f.write("custom once Return: " + message["fields"]["ReturnMessage"] + "\n")
my_returnmessage = message["fields"]["ReturnMessage"]
arg_string+='-r \'' + my_returnmessage + '\' '
except:
pass
try:
f.write("custom once blocked: " + message["fields"]["BlockedFile"] + "\n")
my_blocked_file = message["fields"]["BlockedFile"].replace('"', '')
arg_string+='-b \'' + my_blocked_file + '\' '
except:
pass
try:
f.write("custom once Time: " + message["timestamp"] + "\n")
my_time = message["timestamp"]
arg_string+='-z \'' + my_time + '\' '
except:
pass
f.close
if action == "mail_to_user":
f = open("/tmp/testnotification.log", "a")
f.write("Start action: " + action + "\n")
#script = '/usr/share/graylog-server/scripts/' + action + '.sh ' + ' -a \'' + action + '\' -t \'' + my_to + '\' -f \'' + my_from + '\' -m \'' + my_mailaction + '\' -r \'' + my_returnmessage + '\' -z \'' + my_time + '\' -b \'' + my_blocked_file + '\''
script = '/usr/share/graylog-server/scripts/' + action + '.sh ' + arg_string
f.write("cmd_line: " + script + "\n")
rc = subprocess.Popen(script, shell=True)
f.write("============================================" + "\n")
f.close
# Return an exit value. Zero is success, non-zero indicates failure.
exit(0)
The bash-script which is called looks like following:
#!/bin/bash
##test callback
while getopts f:t:m:r:b:z:a: option; do
case "${option}" in
a) action=${OPTARG};;
m) mailaction=${OPTARG};;
t) to=${OPTARG};;
f) from=${OPTARG};;
r) returnmsg=${OPTARG};;
b) blocked_file=${OPTARG};;
z) my_time="$(date -d "${OPTARG}" +'%d-%m-%Y %H:%M')";;
: ) echo "Missing option argument for -$OPTARG" >&2; exit 1;;
* ) echo "Unimplemented option: -$OPTARG" >&2; exit 1;;
esac
done
# echo "from bash: " >> /tmp/testnotification.log
# echo "a: $action
#m: $mailaction
#t: $to
#f: $from
#b: $blocked_file
#r: $returnmsg
#z: $my_time
#
#start mutt" >> /tmp/testnotification.log
echo -e "
Title:\t\tMail von ${from} blockiert
Wann:\t\t${my_time}
Von:\t\t${from}
An:\t\t${to}
Anhang:\t\t${blocked_file}
Rückmeldung:\t${returnmsg}
mit freudlichen Grüßen
IT-Team
" >> /tmp/$$_mailtext.txt
mutt -e 'set content_type="text/plain" charset="utf-8" realname="IT-Team" from=noreply@MY_DOMAIN' $to -s"Mail was $mailaction" < /tmp/$$_mailtext.txt
rm -f /tmp/$$_mailtext.txt
The generated mail looks like this:
the python-script can be used to parse any fields and use them in other scripts (since im much better on bash than python its simpler for me to call bash-scripts for the actual callback and use the python-script as “parser-only” 
This works fine - thanks for the hint @tmacgbay
//EDIT: notification is set with a static argv:
//EDIT2:
updated the python_parser-script to dynamic building of the cmd_args
this way, there is no chance in calling the bash-script with unset vars - could be enhanced further by skip setting explicit vars for each field and just add
arg_string+='-b \'' + message["fields"]["BlockedFile"].replace('"', '') + '\' '
or
arg_string+='-m \'' + message["fields"]["MailAction"] + '\' '
instead of the var “my_mailaction” or “my_blocked_file” - but this is more readable and can be changed by whoever is using this script
best regards,
coffee_is_life
