Good morning, I have Email alerts setup and working. But would like more information in the alerts. For example, the following message when logged would trigger an e-mail. “error: maximum authentication attempts exceeded for invalid user hacker from X.X.X.X” I would like to include the user (hac…

I’m reading this: Alerts — Graylog 4.0.0 documentation and just not getting it…

Hey @dickinsonzach , it is the ‘lazy’ way but I always just include the message in the email alert as a payload. (enable message backlog) If there’s some reason you don’t want to do that like there’s other information in the message that you don’t want some alert recipients to see, you could set up …

I ended up “getting it”. I made one alert that searched for a few different login failures. Then I made custom fields in that alert for Message and Source. Then in the Notification, I referenced them using {event.fields.Msg} and {event.fields.Src} Msg and Src being the custom fields I setup earl…

Check my previous post about this: [image] Custom notification variables Graylog Central (peer support) You have to setup number of backlog to 1: in Alerts - Event Definitions - tab Notifications and field Message Backlog , tick the checkbox and set 1. Message backlog de…

Thank you, that’s great info. What do you mean by “source of event, not a source device”. In my case they seem to be the same. Thank you, Zach.

Event has also source, which is source of event {event.source}. But if you want to show source of message (source device sending logs), you should use ${message.source}

Email Alerts w/ Additional Information

Graylog Central (peer support)

shoothub (Shoothub) January 12, 2021, 8:59am 5

Check my previous post about this:

Topic		Replies	Views
How to I get extra fields in my E-Mail Notifications? Graylog Central (peer support) basic-configuration , alert	3	4139	April 11, 2022
Alerts and further information Graylog Central (peer support)	7	1027	May 28, 2018
Customise my email alerts Graylog Central (peer support)	5	573	August 1, 2022
Including message contect into alert notification email Graylog Central (peer support)	1	841	July 10, 2017
Including message content into alert notification email Graylog Central (peer support)	2	7799	September 8, 2017

Email Alerts w/ Additional Information

Related topics