# Graylog 4.0 bug with fields and aggregation **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [April 30, 2021, 12:24pm UTC](https://community.graylog.org/t/graylog-4-0-bug-with-fields-and-aggregation/19683 "2021-04-30T12:24:03Z")\ **Posts on this page:** 1\ **Showing post:** 6
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 10, 2021, 10:41pm UTC](https://community.graylog.org/t/graylog-4-0-bug-with-fields-and-aggregation/19683/6 "2021-05-10T22:41:22Z")
Thank you for the addintional information. I understand the issue now. My appologies, I assumed it was from this section that you were talking about. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5015f662d6a81ccfb2bb9bad4b740a73f1b801d5.png) I’m not to familiar with Event fields section. I just never had to use it yet. How ever I did find These , maybe something in there might help. > [@How to define custom field on Event Definition](https://community.graylog.org/t/how-to-define-custom-field-on-event-definition/15712/2): > > Check my previous post in the past: > [@Events fields & notifications](https://community.graylog.org/t/events-fields-notifications/13814): > > Hello, I tried to set up some notifications related to a stream which log autentication failure on SSH The mail notification works well, but lacks of informations. So I tried to add custom fields to the mail body. Here an example of a message that i received with the differents fields : But when I received the mail the custom fields are empty : Fields: level: ip: Do you know how to fix this ? Regards As for creating custum fields you probably can do this on the INPUT by creating a GROK or Regular expression. Then use those fields to filter out what you need. I’m sorry I cant be more help. --- _[View the full topic](https://community.graylog.org/t/graylog-4-0-bug-with-fields-and-aggregation/19683)._