Graylog 4.0 bug with fields and aggregation

[gsmith]

Thank you for the addintional information. I understand the issue now.
My appologies, I assumed it was from this section that you were talking about.

I’m not to familiar with Event fields section. I just never had to use it yet.

How ever I did find These , maybe something in there might help.

How to define custom field on Event Definition

Check my previous post in the past:

Events fields & notifications

Hello, I tried to set up some notifications related to a stream which log autentication failure on SSH The mail notification works well, but lacks of informations. So I tried to add custom fields to the mail body. [image] Here an example of a message that i received with the differents fields : [image] But when I received the mail the custom fields are empty : Fields: level: ip: Do you know how to fix this ? Regards

As for creating custum fields you probably can do this on the INPUT by creating a GROK or Regular expression. Then use those fields to filter out what you need. I’m sorry I cant be more help.