# GrayLog Alert by Custom Field

**URL:** <https://community.graylog.org/t/graylog-alert-by-custom-field/18536>\
**Category:** Graylog Central (peer support)\
**Created:** [January 21, 2021, 9:24am UTC](https://community.graylog.org/t/graylog-alert-by-custom-field/18536 "2021-01-21T09:24:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidfungf](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/davidfungf/32/7843_2.png) [@davidfungf](https://community.graylog.org/u/davidfungf)\
**Post date:** [January 21, 2021, 9:24am UTC](https://community.graylog.org/t/graylog-alert-by-custom-field/18536/1 "2021-01-21T09:24:20Z")

</div>

I am a beginner of Graylog. I want to trigger an alarm based on a field value. For e.g. _@fields\_serverity=“error”_ like the below picture. How to define it in the Template? Thanks.

 ![Test2](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/196765aab9803e59ddae757ba3a95a1572b039cf.png)

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [January 21, 2021, 9:33am UTC](https://community.graylog.org/t/graylog-alert-by-custom-field/18536/2 "2021-01-21T09:33:29Z")

</div>

Please use `Search query` in the `Filter & Aggregation` section, not `Fields`. First check docs, to undestard how it works:  
[https://docs.graylog.org/en/4.0/pages/alerts.html#filter](https://docs.graylog.org/en/4.0/pages/alerts.html#filter)

---

<div class="post-metadata">

**Author:** ![dickinsonzach](https://avatars.discourse-cdn.com/v4/letter/d/e19b73/32.png) [@dickinsonzach](https://community.graylog.org/u/dickinsonzach)\
**Post date:** [January 21, 2021, 2:03pm UTC](https://community.graylog.org/t/graylog-alert-by-custom-field/18536/3 "2021-01-21T14:03:12Z")

</div>

Good morning, if I follow you want to trigger an Event and the send a Notification when a device logs something with “error”.

Under Alerts, you would Create Event Definition. Then under Filter & Aggregation you would put in your Search Query to find what you’re looking for (Make sure you get some results on the right hand side. And example I have is:

“Low” AND ?x NOT “Cleared”

That will find anything with the word Low AND ?x (? is a single character wild card), but NOT the word Cleared.

Then the fields are

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/9ea7e444be52234ef2034d51473463376a45c4a5.png)  
which are not used to search on, but to be referenced in my Email alert as {event.fields.Msg} and {event.fields.Src}

Thank you, Zach.

---

<div class="post-metadata">

**Author:** ![davidfungf](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/davidfungf/32/7843_2.png) [@davidfungf](https://community.graylog.org/u/davidfungf)\
**Post date:** [January 22, 2021, 4:03pm UTC](https://community.graylog.org/t/graylog-alert-by-custom-field/18536/4 "2021-01-22T16:03:19Z")

</div>

Thank you for your input. I can trigger an alert.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 5, 2021, 4:04pm UTC](https://community.graylog.org/t/graylog-alert-by-custom-field/18536/5 "2021-02-05T16:04:04Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.