# Graylog Alert Email Callback Variables

**URL:** https://community.graylog.org/t/graylog-alert-email-callback-variables/5201
**Category:** Graylog Central (peer support)
**Tags:** winlogbeat, sidecar
**Created:** [May 9, 2018, 7:11pm UTC](https://community.graylog.org/t/graylog-alert-email-callback-variables/5201 "2018-05-09T19:11:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![SteveCGI](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@SteveCGI](https://community.graylog.org/u/SteveCGI)
#### Post date: [May 9, 2018, 7:11pm UTC](https://community.graylog.org/t/graylog-alert-email-callback-variables/5201/1 "2018-05-09T19:11:11Z")

</div>

Hi, I am trying to configure email callback alerts which contain some variables in the body of the email. I have been unsuccessful so far. I understand that you have to enclose your fields in a loop on the backlog object, but I haven’t got the format quite right apparently. The variables in the body of the email show up empty. I have googled for hours and tried many formats that other people have reported to work successfully. I have pasted 2 formats below - one is the default template, and the other is a supposedly working example using the backlog object loop. Please help if my syntax is wrong. Even getting a single variable to show up will be immensely helpful.

**Default Template:**  
Machine: {message.winlogbeat\_computer\_name} Name: {message.fields.Name}  
EventID: {message.fields.EventID} Alert Description: {check\_result.resultDescription}  
Date: {check\_result.triggeredAt} Stream ID: {stream.id}  
Stream title: {stream.title} Stream description: {stream.description}  
Alert Condition Title: {alertCondition.title} {if stream\_url}Stream URL: {stream\_url}{end}

Triggered condition: ${check\_result.triggeredCondition}  
##########

{if backlog}Last messages accounting for this alert: {foreach backlog message}{message} {message.fields.EventID}  
{end}{else}  
${end}  
email\_receivers: [steven.ochs@cgi.com](mailto:steven.ochs@cgi.com)  
sender: [graylog@cgi.com](mailto:graylog@cgi.com)  
subject: 101 User Logged into Windows online  
user\_receivers:

**Template using backlog object loop:**  
##########  
Alert Description: ${check\_result.resultDescription}

Date: ${check\_result.triggeredAt}

Stream ID: ${stream.id}

Stream title: ${stream.title}

Stream description: ${stream.description}

Alert Condition Title: ${alertCondition.title}

{if stream\_url}Stream URL: {stream\_url}

{if backlog}{foreach backlog message} {message.fields.EventID}  
{message.fields.TargetUserName} {message.fields.SubjectUserName}  
{end}{else}  
${end}

Triggered condition: ${check\_result.triggeredCondition}  
##########

${if backlog}Last messages accounting for this alert:

{foreach backlog message}{message}

{end}{else}  
${end}

Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [May 23, 2018, 7:11pm UTC](https://community.graylog.org/t/graylog-alert-email-callback-variables/5201/2 "2018-05-23T19:11:13Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.