Dynamic HTTP notifications possible?

Graylog Central (peer support)
1

Is it possible to include message info in a HTTP notification?

I want to dynamically send HTTP notifications by using the message source name. For instance:

URL:
http://somesite.com/${message.source}

Thanks in advance!

2

Hello and Welcome,

I believe it can be done. I havent used HTTP notifications in my environment but I have done this with Email notifications.

Is this what you refering to as shown below?

https://graylog-server.domain.com:9000/messages/${message.index}/${message.id}

This is the Notification configuration.

--- [Event Definition] ---------------------------
Title:       ${event_definition_title}
Description: ${event_definition_description}
Type:        ${event_definition_type}
--- [Event] --------------------------------------
Timestamp:            ${event.timestamp}
Message:              ${event.message}
Source:               ${event.source}
Priority:             ${event.priority}
Alert:                ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start:      ${event.timerange_start}
Timerange End:        ${event.timerange_end}
Stream URL:           ${event.stream_name}          
${if stream_url}Stream URL: ${stream_url}${end}

${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
https://graylog-server.domain.com:9000/messages/${message.index}/${message.id}
User:             ${message.fields.TargetUserName}
WorkStation Name:  ${message.fields.WorkstationName}
Event Time:       ${message.fields.EventReceivedTime}
Source:           ${message.source}
Logon Type:       ${message.LogonType}
---[backlog end]---------------------------------
${end}
${end}

Hope that helps

3

Hello gsmith,

Thanks for your reply. I’m indeed referring to the message info you have replied, but it seems this only works for the e-mail notifications. What I want to do is send HTTP notifications to urls which have message information in them.

So for instance; when there are any rsyslog level 0 messages found I want to send a HTTP notification to the url http://somesite?msg=lvl_0_logs_found_from_${message.source}. When there are any rsyslog level 1 messages found; a HTTP notification to http://somesite?msg=lvl_1_logs_found_from_${message.source} etc.

4

Hello,

Have you seen this?

https://docs.graylog.org/en/4.0/pages/plugins/event_notifications.html#example-event-notification

5

Hello gsmith,

Thank you! I had been searching for an answer on the forum already but didn’t find the thread you’ve replied. That fixes it! :smiley:

1 Like
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.