# Alerts with Mailreceiver from messagefield

**URL:** <https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981>\
**Category:** Graylog Central (peer support)\
**Created:** [August 24, 2021, 3:11pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981 "2021-08-24T15:11:27Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![coffee\_is\_life1337](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/coffee_is_life1337/32/9222_2.png) [@coffee\_is\_life1337](https://community.graylog.org/u/coffee_is_life1337)\
**Post date:** [August 24, 2021, 3:11pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/1 "2021-08-24T15:11:27Z")

</div>

Hello Forum,

i asked a question some days ago about email notification which sould use an receiver from message field.  
unfortunatly this topic was closed since nobody knew an answer, but im still on it.

Challenge:  
use a field (like ${foreach backlog message}${message.fields.to}${end} ) as email receiver.

i was able to use the backlog message successfully as email-subject (with the above shown method).  
But Graylog denies to use this as receiver.

This topic/question should be moved to “daily challnges” or “development” but i cant create there.

i can ensure that the used field is always present when the alert is triggerd.  
Since graylog is validating the mail-receiver in notification-tab i cant even create it.

is it possible to implement another field (besides user or explicit email) to use a mail from message?

best regards,  
coffee\_is\_life1337

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 25, 2021, 1:59am UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/2 "2021-08-25T01:59:29Z")

</div>

Hello,

If I understand you correct, are you referring to this section of the Notification area?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c97971703c4190ff126d4587933324e6733ccc8c.png)

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/3b318f5ba020d54954d514dc01a05590c01468d4.png)

---

<div class="post-metadata">

**Author:** ![coffee\_is\_life1337](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/coffee_is_life1337/32/9222_2.png) [@coffee\_is\_life1337](https://community.graylog.org/u/coffee_is_life1337)\
**Post date:** [August 30, 2021, 9:55am UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/3 "2021-08-30T09:55:11Z")

</div>

@gsmith,

thats correct, but when i try to refer to a field (“to”) from a message its not working. If i try to use the notification receiver “to” field, graylog is throwing this error (message field “to” is filled with my correct email) :

The Graylog server encountered an error while trying to send an email. This is the detailed error message: org.apache.commons.mail.EmailException: javax.mail.internet.AddressException: Missing final ‘@domain’ in string `${message.fields.to}'' (javax.mail.internet.AddressException: Missing final '@domain' in string `${message.fields.to}’’)

 ![grafik](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f40b41e71a57395b449a14cac2b624bbc03a2d2e.png)

if i use only ${message.to} i get following error (similar)

 ![grafik](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/378e5fc2145628e02751cd69a7c024f310a6cc97.png)

Notification:

 ![grafik](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/56e2aad94fffc06969ba9d94d3ea6d2f649ba289.png)

//EDIT: Same with only “${to}” in Email recipients and “${foreach backlog message}${message.fields.to}${end}”.

 ![grafik](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a4f2435184dee476eb3ff06f27983f24f9dce295.png)

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 30, 2021, 9:45pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/4 "2021-08-30T21:45:16Z")

</div>

Correct me if I’m wrong but your trying to use a Macro for an email account or use it as Cc?  
I tested this but have the same results. Not 100% sure if graylog can process something like this yet

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/dad848ac23c4d09c82b0f6cc2b92552423f9cf4b.png)

Just a thought, does the “to” field have a email address?

---

<div class="post-metadata">

**Author:** ![coffee\_is\_life1337](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/coffee_is_life1337/32/9222_2.png) [@coffee\_is\_life1337](https://community.graylog.org/u/coffee_is_life1337)\
**Post date:** [August 31, 2021, 3:05pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/5 "2021-08-31T15:05:39Z")

</div>

quote from first entry:  
“i can ensure that the used field is always present when the alert is triggerd.”

but for clarification, yes, the “to”-field is always filled with a valid mail address.  
The field is filled with pipeline-processors.

i can imagine, that graylog checks the mail before filling the variable or its out of boundaries to use a field from the original message there.

i want to use the alert as following:

we have postfix header and mime-header checks on wich our mailserver decides if the mail will be delivered, redirected or rejected. (works fine, just to get the whole picture)  
currently itjujst do it’s things and nobody knows if a mail was redirected (besides the admins who are working with graylog and see the logs/dashboard).  
i want to triggern an alert if a mail was rejected (alert triggers, everything fine)  
now i want to generate an email nto notify the user which should have received the redirected/rejected message.  
just to inform him: "hey, there was an email for you, but it was redirected because of "

the reason, the original recipient and the action are all in graylog, each got a field.  
now i just want to use the “to”-field to send the alert template to this specific user.

best regards,  
coffee\_is\_life1337

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [August 31, 2021, 11:06pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/6 "2021-08-31T23:06:59Z")

</div>

Hello,

> [@coffee\_is\_life1337](#):
>
> quote from first entry:  
> “i can ensure that the used field is always present when the alert is triggerd.”

Sorry I have missed that.

I understand now, actually that is something similar here but were taking the long route. For our redirected/rejected notification come from the _mail.log_ then filtered to a stream. once processed then the proper tech gets the alert if it was redirected or dropped. Unfortunately, I’m not sure how to solve your issue.

Sorry I cant be more help.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [August 31, 2021, 11:11pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/7 "2021-08-31T23:11:29Z")

</div>

You could likely script a response (Enterprise required) that could be sent to the contents of a field. You can get the enterprise license free if you are under 5GB a day…

---

<div class="post-metadata">

**Author:** ![coffee\_is\_life1337](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/coffee_is_life1337/32/9222_2.png) [@coffee\_is\_life1337](https://community.graylog.org/u/coffee_is_life1337)\
**Post date:** [September 1, 2021, 2:14pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/8 "2021-09-01T14:14:08Z")

</div>

Hello @tmacgbay,

im using enterprise since 1 week and didnt notice the _new_ script callback function 🙂  
after some try and error i got the following, based on the script from documentation:  
(still on python2, so i need to add “print” as function to use it)

```auto
#!/usr/bin/env python2
from __future__ import print_function
import json
import sys
import subprocess

# Main function
if __name__ == " __main__":

    # Print out all input arguments.
    action = sys.argv[1]
    f = open("/tmp/testnotification.log", "a")
    f.write("Action: " + action + "\n")
    for i in sys.argv[2:]:
      f.write("Arguments: " + i + "\n")
    f.close
    # Turn stdin.readlines() array into a string
    std_in_string = ''.join(sys.stdin.readlines())

    # Load JSON
    event_data = json.loads(std_in_string)

    # Extract Message Backlog field from JSON.
    f = open("/tmp/testnotification.log", "a")
    f.write("\nBacklog:\n")
    arg_string=""
    for message in event_data["backlog"]:
        try:
          f.write("custom once to: " + message["fields"]["to"] + "\n")
          my_to = message["fields"]["to"]
          arg_string+='-t \'' + my_to + '\' '
        except:
          pass
        try:
          f.write("custom once from: " + message["fields"]["from"] + "\n")
          my_from = message["fields"]["from"]
          arg_string+='-f \'' + my_from + '\' '
        except:
          pass
        try:
          f.write("custom once MailAction: " + message["fields"]["MailAction"] + "\n")
          my_mailaction = message["fields"]["MailAction"]
          arg_string+='-m \'' + my_mailaction + '\' '
        except:
          pass
        try:
          f.write("custom once Return: " + message["fields"]["ReturnMessage"] + "\n")
          my_returnmessage = message["fields"]["ReturnMessage"]
          arg_string+='-r \'' + my_returnmessage + '\' '
        except:
          pass
        try:
          f.write("custom once blocked: " + message["fields"]["BlockedFile"] + "\n")
          my_blocked_file = message["fields"]["BlockedFile"].replace('"', '')
          arg_string+='-b \'' + my_blocked_file + '\' '
        except:
          pass
        try:
          f.write("custom once Time: " + message["timestamp"] + "\n")
          my_time = message["timestamp"]
          arg_string+='-z \'' + my_time + '\' '
        except:
          pass
        f.close

    if action == "mail_to_user":
      f = open("/tmp/testnotification.log", "a")
      f.write("Start action: " + action + "\n")
      #script = '/usr/share/graylog-server/scripts/' + action + '.sh ' + ' -a \'' + action + '\' -t \'' + my_to + '\' -f \'' + my_from + '\' -m \'' + my_mailaction + '\' -r \'' + my_returnmessage + '\' -z \'' + my_time + '\' -b \'' + my_blocked_file + '\''
      script = '/usr/share/graylog-server/scripts/' + action + '.sh ' + arg_string
      f.write("cmd_line: " + script + "\n")
      rc = subprocess.Popen(script, shell=True)
      f.write("============================================" + "\n")
      f.close

    # Return an exit value. Zero is success, non-zero indicates failure.
    exit(0)

```

The bash-script which is called looks like following:

```auto
#!/bin/bash
##test callback
while getopts f:t:m:r:b:z:a: option; do
  case "${option}" in
        a) action=${OPTARG};;
        m) mailaction=${OPTARG};;
        t) to=${OPTARG};;
        f) from=${OPTARG};;
        r) returnmsg=${OPTARG};;
        b) blocked_file=${OPTARG};;
        z) my_time="$(date -d "${OPTARG}" +'%d-%m-%Y %H:%M')";;
        : ) echo "Missing option argument for -$OPTARG" >&2; exit 1;;
        * ) echo "Unimplemented option: -$OPTARG" >&2; exit 1;;
  esac
done
# echo "from bash: " >> /tmp/testnotification.log
# echo "a: $action
#m: $mailaction
#t: $to
#f: $from
#b: $blocked_file
#r: $returnmsg
#z: $my_time
#
#start mutt" >> /tmp/testnotification.log

echo -e "
Title:\t\tMail von ${from} blockiert

Wann:\t\t${my_time}
Von:\t\t${from}
An:\t\t${to}
Anhang:\t\t${blocked_file}

Rückmeldung:\t${returnmsg}

mit freudlichen Grüßen
IT-Team
" >> /tmp/$$_mailtext.txt

mutt -e 'set content_type="text/plain" charset="utf-8" realname="IT-Team" from=noreply@MY_DOMAIN' $to -s"Mail was $mailaction" < /tmp/$$_mailtext.txt

rm -f /tmp/$$_mailtext.txt

```

The generated mail looks like this:

 ![grafik](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/afb35e611acbfc2c91f4215e6506267f4cf43fea.png)

the python-script can be used to parse any fields and use them in other scripts (since im much better on bash than python its simpler for me to call bash-scripts for the actual callback and use the python-script as “parser-only” 😃

This works fine - thanks for the hint @tmacgbay

//EDIT: notification is set with a static argv:

 ![grafik](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/78f49ca25b821a17fc9f962bda723df7596fafdd.png)

//EDIT2:  
updated the python\_parser-script to dynamic building of the cmd\_args  
this way, there is no chance in calling the bash-script with unset vars - could be enhanced further by skip setting explicit vars for each field and just add

```auto
arg_string+='-b \'' + message["fields"]["BlockedFile"].replace('"', '') + '\' '

```

or

```auto
arg_string+='-m \'' + message["fields"]["MailAction"] + '\' '

```

instead of the var “my\_mailaction” or “my\_blocked\_file” - but this is more readable and can be changed by whoever is using this script 🙂

best regards,  
coffee\_is\_life

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [September 1, 2021, 3:05pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/9 "2021-09-01T15:05:23Z")

</div>

Great!! Thanks for posting your work for others!

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [September 1, 2021, 9:37pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/10 "2021-09-01T21:37:33Z")

</div>

I must say that’s pretty amazing, Nice Job 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 15, 2021, 9:37pm UTC](https://community.graylog.org/t/alerts-with-mailreceiver-from-messagefield/20981/11 "2021-09-15T21:37:45Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.