# Extractors value in body of notifications

**URL:** <https://community.graylog.org/t/extractors-value-in-body-of-notifications/13484>\
**Category:** Graylog Central (peer support)\
**Created:** [January 15, 2020, 11:49am UTC](https://community.graylog.org/t/extractors-value-in-body-of-notifications/13484 "2020-01-15T11:49:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nsecurity1](https://avatars.discourse-cdn.com/v4/letter/n/82dd89/32.png) [@nsecurity1](https://community.graylog.org/u/nsecurity1)\
**Post date:** [January 15, 2020, 11:49am UTC](https://community.graylog.org/t/extractors-value-in-body-of-notifications/13484/1 "2020-01-15T11:49:45Z")

</div>

Hi all,

i can’t undestand how to call an extractor variable inside the body of email notifications.  
In legacy alarm callbacks i use for example ${message.fields.from} but in new configuration which is the right syntax?

thanks

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [January 15, 2020, 12:27pm UTC](https://community.graylog.org/t/extractors-value-in-body-of-notifications/13484/2 "2020-01-15T12:27:04Z")

</div>

Hello, syntax is the same also in latest version 3.1

Check if you setup correctly **Message Backlog** parameter in **Alerts - Event Definitions - Edit - tab Notification** , _check_ field **Message Backlog** and set to **1**. It’s a number of messages to be included in Notification, if 0 no field will be extracted in message.

I use for example this snippet after user connect to switch:

```auto
${if backlog}
${foreach backlog message}
    User ${message.fields.username} connected to switch ${message.source} from IP ${message.fields.src_ip}
${end}
${end}

```

You can use same syntax also in Subject field, for example I use:

> Graylog event notification: ${event\_definition\_title} to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src\_ip}${end}

---

<div class="post-metadata">

**Author:** ![nsecurity1](https://avatars.discourse-cdn.com/v4/letter/n/82dd89/32.png) [@nsecurity1](https://community.graylog.org/u/nsecurity1)\
**Post date:** [January 15, 2020, 1:01pm UTC](https://community.graylog.org/t/extractors-value-in-body-of-notifications/13484/3 "2020-01-15T13:01:12Z")

</div>

perfect resolved  
thank you very much 😁

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 29, 2020, 1:01pm UTC](https://community.graylog.org/t/extractors-value-in-body-of-notifications/13484/4 "2020-01-29T13:01:19Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.