# Email Alert Notification
**URL:** https://community.graylog.org/t/email-alert-notification/16442
**Category:** Graylog Central (peer support)
**Created:** [July 20, 2020, 11:21am UTC](https://community.graylog.org/t/email-alert-notification/16442 "2020-07-20T11:21:33Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@onkargl007](https://community.graylog.org/u/onkargl007)
#### Post date: [July 20, 2020, 11:21am UTC](https://community.graylog.org/t/email-alert-notification/16442/1 "2020-07-20T11:21:33Z")
Greetings Team,
i have configured the email based alert notification but email i am getting its not as expected, below is the configuration…
Email Body Template:
# — [Event Definition] --------------------------- Title: {event\_definition\_title} Description: {event\_definition\_description} Type: {event\_definition\_type} --- [Event] -------------------------------------- Timestamp: {message.fields.timestamp} Source: {message.fields.Device\_Name} Severity: {message.fields.Severity} Message\_Code: {message.fields.Message\_Code} Message: {message.fields.Message} Priority: {event.priority} Alert: {event.alert} Fields: {message.message} {foreach event.fields field} {field.key}: {field.value} {end} {if backlog} — [Backlog] ------------------------------------ Last messages accounting for this alert: {foreach backlog message} {message} {end} {end}
Event Filter (Search Query):
# ============================================= below email i am getting: — [Event Definition] --------------------------- Title: Alerts\_For\_Critical\_Alarms Description: Type: aggregation-v1 — [Event] -------------------------------------- Timestamp: Source: Severity: Message\_Code: Message: Priority: 3 Alert: true Fields:
---
### Author:  [@Ponet](https://community.graylog.org/u/Ponet)
#### Post date: [July 20, 2020, 11:23am UTC](https://community.graylog.org/t/email-alert-notification/16442/2 "2020-07-20T11:23:31Z")
You haven’t said what you are expecting but, I assume you are wondering why there is no backlog included.
Check your event definition which triggers this notification.
In the notification section of the event definition, make sure you have enabled the backlog set it to include at least 1 message.
---
### Author:  [@onkargl007](https://community.graylog.org/u/onkargl007)
#### Post date: [July 20, 2020, 11:32am UTC](https://community.graylog.org/t/email-alert-notification/16442/3 "2020-07-20T11:32:19Z")
hey, thanks for your prompt response…
below is the event definition i have configured,
### Filter & Aggregation
Type
Filter
Search Query
Severity:(1 OR 2 OR 3)
Streams
[All messages](http://netopps.g42cloud.net:9000/streams/000000000000000000000001/search)
Search within
1 minutes
Execute search every
1 minutes
Enable scheduling
# yes
let me know what need to change in email body settings…
---
### Author:  [@Ponet](https://community.graylog.org/u/Ponet)
#### Post date: [July 20, 2020, 11:35am UTC](https://community.graylog.org/t/email-alert-notification/16442/4 "2020-07-20T11:35:08Z")
You still haven’t said what you’re expecting to see so, I don’t know what should be changed in the email body.
---
### Author:  [@onkargl007](https://community.graylog.org/u/onkargl007)
#### Post date: [July 20, 2020, 12:12pm UTC](https://community.graylog.org/t/email-alert-notification/16442/5 "2020-07-20T12:12:50Z")
the email notification that i am receiving from graylog is as below, it does not contain the required information, for example i want to get an info related to source, severity, message\_code, etc in email notification…
— [Event Definition] ---------------------------
Title: Alerts\_For\_Critical\_Alarms
Description:
Type: aggregation-v1
— [Event] --------------------------------------
Timestamp:
Source:
Severity:
Message\_Code:
Message:
Priority: 3
Alert: true
Fields:
---
### Author:  [@Ponet](https://community.graylog.org/u/Ponet)
#### Post date: [July 20, 2020, 12:21pm UTC](https://community.graylog.org/t/email-alert-notification/16442/6 "2020-07-20T12:21:24Z")
Okay, looking over the email body again, you are trying to use values within the `$message` object.
You can only do that while iterating over the backlog, see the following documentation:
[https://docs.graylog.org/en/3.3/pages/alerts.html#data-available-to-notifications](https://docs.graylog.org/en/3.3/pages/alerts.html#data-available-to-notifications)
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [August 3, 2020, 12:21pm UTC](https://community.graylog.org/t/email-alert-notification/16442/7 "2020-08-03T12:21:28Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.