Dynamic HTTP notifications possible?

[Stokvisss (Nathan)]

Is it possible to include message info in a HTTP notification?

I want to dynamically send HTTP notifications by using the message source name. For instance:

URL:
http://somesite.com/${message.source}

Thanks in advance!

[gsmith]

Hello and Welcome,

@Stokvisss

Is it possible to include message info in a HTTP notification?

I believe it can be done. I havent used HTTP notifications in my environment but I have done this with Email notifications.

Is this what you refering to as shown below?

https://graylog-server.domain.com:9000/messages/${message.index}/${message.id}

This is the Notification configuration.

--- [Event Definition] ---------------------------
Title:       ${event_definition_title}
Description: ${event_definition_description}
Type:        ${event_definition_type}
--- [Event] --------------------------------------
Timestamp:            ${event.timestamp}
Message:              ${event.message}
Source:               ${event.source}
Priority:             ${event.priority}
Alert:                ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start:      ${event.timerange_start}
Timerange End:        ${event.timerange_end}
Stream URL:           ${event.stream_name}          
${if stream_url}Stream URL: ${stream_url}${end}

${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
https://graylog-server.domain.com:9000/messages/${message.index}/${message.id}
User:             ${message.fields.TargetUserName}
WorkStation Name:  ${message.fields.WorkstationName}
Event Time:       ${message.fields.EventReceivedTime}
Source:           ${message.source}
Logon Type:       ${message.LogonType}
---[backlog end]---------------------------------
${end}
${end}

Hope that helps

[Stokvisss (Nathan)]

Hello gsmith,

Thanks for your reply. I’m indeed referring to the message info you have replied, but it seems this only works for the e-mail notifications. What I want to do is send HTTP notifications to urls which have message information in them.

So for instance; when there are any rsyslog level 0 messages found I want to send a HTTP notification to the url http://somesite?msg=lvl_0_logs_found_from_${message.source}. When there are any rsyslog level 1 messages found; a HTTP notification to http://somesite?msg=lvl_1_logs_found_from_${message.source} etc.

[gsmith]

Hello,

Have you seen this?

How to pass variables in Alert Configuration

hello, I’m trying to pass variables in Alert Configuration. I’ve tried HTTP Callback Alarm in the form Editing alert configuration : Title : Test Alert URL : http://server/graylog.php?info=${message} I try to pass message or id message : I set with the syntax “${message}”… Is there a way to pass the variable please ?

Make it possible to customize the HTTP(s) POST notification

Support for HTML email alerts/notifications

https://docs.graylog.org/en/4.0/pages/plugins/event_notifications.html#example-event-notification

[Stokvisss (Nathan)]

Hello gsmith,

Thank you! I had been searching for an answer on the forum already but didn’t find the thread you’ve replied. That fixes it!