# Email notification winlogbeat

**URL:** https://community.graylog.org/t/email-notification-winlogbeat/3545
**Category:** Graylog Central (peer support)
**Tags:** winlogbeat, sidecar
**Created:** [December 18, 2017, 11:54am UTC](https://community.graylog.org/t/email-notification-winlogbeat/3545 "2017-12-18T11:54:29Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jerichoussr](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@jerichoussr](https://community.graylog.org/u/jerichoussr)
#### Post date: [December 18, 2017, 11:54am UTC](https://community.graylog.org/t/email-notification-winlogbeat/3545/1 "2017-12-18T11:54:29Z")

</div>

Hi. I made this template:

> Stream title: ${stream.title}  
> Alert Condition Title: ${alertCondition.title}
> 
> Date: ${check\_result.triggeredAt}  
> Source:${source}  
> Login:${message.fields.winlogbeat\_event\_data\_TargetUserName}
> 
> ${if stream\_url}  
> Stream URL: ${stream\_url}${end}
> 
> Login: {foreach backlog message}${message.winlogbeat\_event\_data\_TargetUserName}
> 
> ${if backlog}Last messages accounting for this alert:  
> ${foreach backlog message}${message}
> 
> ${end}${else}  
> ${end}

But "winlogbeat\_event\_data\_TargetUserName’ wasn’t showed. What I did wrong?  
Thank you

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [January 1, 2018, 11:55am UTC](https://community.graylog.org/t/email-notification-winlogbeat/3545/2 "2018-01-01T11:55:07Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.