Hey @SalC
Ok so the message fields work.
As for your Event section try this. The thing is those are events
--- [Event] --------------------------------------
Timestamp: ${event.timestamp}
Message: ${event.message}
Source: ${event.source}
Key: ${event.key}
Priority: ${event.priority}
Alert: ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start: ${event.timerange_start}
Timerange End: ${event.timerange_end}
I did something like this a while back. If they don’t show , that mean the naming configuration is incorrect.