Good morning, I have Email alerts setup and working. But would like more information in the alerts. For example, the following message when logged would trigger an e-mail. “error: maximum authentication attempts exceeded for invalid user hacker from X.X.X.X” I would like to include the user (hac…

I’m reading this: Alerts — Graylog 4.0.0 documentation and just not getting it…

Hey @dickinsonzach , it is the ‘lazy’ way but I always just include the message in the email alert as a payload. (enable message backlog) If there’s some reason you don’t want to do that like there’s other information in the message that you don’t want some alert recipients to see, you could set up …

I ended up “getting it”. I made one alert that searched for a few different login failures. Then I made custom fields in that alert for Message and Source. Then in the Notification, I referenced them using {event.fields.Msg} and {event.fields.Src} Msg and Src being the custom fields I setup earl…

Check my previous post about this: [image] Custom notification variables Graylog Central (peer support) You have to setup number of backlog to 1: in Alerts - Event Definitions - tab Notifications and field Message Backlog , tick the checkbox and set 1. Message backlog de…

Thank you, that’s great info. What do you mean by “source of event, not a source device”. In my case they seem to be the same. Thank you, Zach.

Event has also source, which is source of event {event.source}. But if you want to show source of message (source device sending logs), you should use ${message.source}

Email Alerts w/ Additional Information

Graylog Central (peer support)

shoothub (Shoothub) January 12, 2021, 8:59am 5

Check my previous post about this:

Topic		Replies	Views
How to I get extra fields in my E-Mail Notifications? Graylog Central (peer support) basic-configuration , alert	4	4098	April 25, 2022
Alerts and further information Graylog Central (peer support)	8	1001	June 11, 2018
Customise my email alerts Graylog Central (peer support)	6	548	August 15, 2022
Including message contect into alert notification email Graylog Central (peer support)	2	823	July 24, 2017
Including message content into alert notification email Graylog Central (peer support)	3	7782	September 22, 2017

Email Alerts w/ Additional Information

Related topics