# Custom notification variables

**URL:** https://community.graylog.org/t/custom-notification-variables/15667
**Category:** Graylog Central (peer support)
**Tags:** winlogbeat, sidecar
**Created:** [May 28, 2020, 1:26pm UTC](https://community.graylog.org/t/custom-notification-variables/15667 "2020-05-28T13:26:43Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [June 10, 2020, 1:13pm UTC](https://community.graylog.org/t/custom-notification-variables/15667/7 "2020-06-10T13:13:18Z")

</div>

You have to setup number of backlog to 1: in ` Alerts - Event Definitions - tab Notifications and field Message Backlog` , tick the checkbox and set 1.

_Message backlog define number of messages to be included in Notifications._

Source in default template for notification use {event.source}, which is source of event, not a source device.

If you want device source included in notification message use:  
`${foreach backlog message}${message.source}${end}`

If you want to use user field (for example: src\_ip) use `{$message.fields.src_ip}` :  
` ${foreach backlog message}${message.fields.src_ip}${end}`

For example I use this message text after somebody connect to switch:  
` {foreach backlog message} Source device: {message.source} Username: {message.fields.username} IP: {message.fields.src_ip} ${end}`

You can also use same technique in message subject, for example I use this:  
`User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}`

Hope it helps.

---

_[View the full topic](https://community.graylog.org/t/custom-notification-variables/15667)._