# Graylog Email Alerts - Passing Variables to body of email message

**URL:** <https://community.graylog.org/t/graylog-email-alerts-passing-variables-to-body-of-email-message/5358>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, winlogbeat\
**Created:** [May 25, 2018, 5:00pm UTC](https://community.graylog.org/t/graylog-email-alerts-passing-variables-to-body-of-email-message/5358 "2018-05-25T17:00:40Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SteveCGI](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@SteveCGI](https://community.graylog.org/u/SteveCGI)\
**Post date:** [May 25, 2018, 5:00pm UTC](https://community.graylog.org/t/graylog-email-alerts-passing-variables-to-body-of-email-message/5358/1 "2018-05-25T17:00:40Z")

</div>

Hi, I am trying to configure email callback alerts which contain some variables in the body of the email. I have been unsuccessful so far. I understand that you have to enclose your fields in a loop on the backlog object, but I haven’t got the format quite right apparently. The variables in the body of the email show up empty. I have googled for hours and tried many formats that other people have reported to work successfully. I have pasted 2 formats below - one is the default template, and the other is a supposedly working example using the backlog object loop. Please help if my syntax is wrong. **Even getting a single variable to show up will be immensely helpful.**

Default Template:  
Machine: {message.winlogbeat\_computer\_name} Name: {message.fields.Name}  
EventID: {message.fields.EventID} Alert Description: {check\_result.resultDescription}  
Date: {check\_result.triggeredAt} Stream ID: {stream.id}  
Stream title: {stream.title} Stream description: {stream.description}  
Alert Condition Title: {alertCondition.title} {if stream\_url}Stream URL: {stream\_url}{end}

Triggered condition: ${check\_result.triggeredCondition}  
##########

{if backlog}Last messages accounting for this alert: {foreach backlog message}{message} {message.fields.EventID}  
{end}{else}  
${end}  
email\_receivers: [steven.ochs@cgi.com](mailto:steven.ochs@cgi.com)  
sender: [graylog@cgi.com](mailto:graylog@cgi.com)  
subject: 101 User Logged into Windows online  
user\_receivers:

Template using backlog object loop:  
##########  
Alert Description: ${check\_result.resultDescription}

Date: ${check\_result.triggeredAt}

Stream ID: ${stream.id}

Stream title: ${stream.title}

Stream description: ${stream.description}

Alert Condition Title: ${alertCondition.title}

{if stream\_url}Stream URL: {stream\_url}

{if backlog}{foreach backlog message} {message.fields.EventID}  
{message.fields.TargetUserName} {message.fields.SubjectUserName}  
{end}{else}  
${end}

Triggered condition: ${check\_result.triggeredCondition}  
##########

${if backlog}Last messages accounting for this alert:

{foreach backlog message}{message}

{end}{else}  
${end}

Thank you!

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [May 25, 2018, 6:35pm UTC](https://community.graylog.org/t/graylog-email-alerts-passing-variables-to-body-of-email-message/5358/2 "2018-05-25T18:35:34Z")

</div>

Please refer to [http://docs.graylog.org/en/2.4/pages/streams/alerts.html#email-alert-notification](http://docs.graylog.org/en/2.4/pages/streams/alerts.html#email-alert-notification) for details about the email alarm callback.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 8, 2018, 6:35pm UTC](https://community.graylog.org/t/graylog-email-alerts-passing-variables-to-body-of-email-message/5358/3 "2018-06-08T18:35:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.