Difference between notification backlog variables and event data variables


can someone explain to me the difference between use backlog variables and event data variables, i understand that “The event as it is stored in Graylog” and backlog (List of Message summaries) - The list of messages or events which lead to this alert being generated but can I use both in a notification, for example, an email notification? I tried but only I am getting data from backlog variables and not from event data

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.