Event Definitions Setup Help

[monarch684 (Joseph)]

1. Describe your incident: Needing to create an event definition with an additional field for hostname
2. Describe your environment:

Redhat 8
Graylog v4.3.5

3. What steps have you already taken to try and solve the problem? I have setup a definition that works successfully, but when adding a custom field for Hostname, I get nothing.

I am using the following template

${source.hostname}

I am not sure if this is correct or not.

4. How can the community help? Point in the proper direction for Event Definitions Template information.

[gsmith]

Hey @monarch684

@monarch684

${source.hostname}

Not sure if thats a template, perhaps if you can share what you configured would help.

[monarch684 (Joseph)]

Does this help?

[gsmith]

Hey @monarch684

Thanks for the added info, What I did was the following for my Active directory.

Example:

This will show up Under alerts.

EDIT:
I also found this for ya, hopeit helps.

Events and custom fields

Hi, I am fairly new to Graylog, having done a Graylog 4.1.3 installation from scratch on Debian 10, Elasticsearch 7.10. So far, a lot of things are running smoothly, but I have problems understanding the concept of custom fields in alerts/events. Exact usecase: I have an aggregation event that collects Windows Event ID 4625 (failed logon) over 5 minutes. If there are more than 4 events for the same User (Aggregation → Group by field(s) → “TargetUserName”) , the event is triggered. This works …