How do i get message data into an alert notification?

Graylog Central (peer support)
1

hi, i am new to graylog, I have installed the system and it is ingesting logs without issue. i am setting up some basic alerts but i am confused on how to include message data in an alert log. i am using sidecar with winlogbeat. I have created an alert for “locked out user” and i would like to include

winlogbeat_winlog_event_data_TargetUserName

in the alert message…how do i do that?

thanks

2

I think it would look like this:

${foreach backlog message}
         ${message.fields.winlogbeat_winlog_event_data_TargetUserName}
{end}

I don’t recall the explanation off -hand (at home, all the cool stuff is at work) but this should pull the data from all messages within your backlog time period.

3

thanks, i will give this a shot

4

ok, i put this in the message:

image
image944×97 8.59 KB

and the email gave me this:
image
but when i go to the logs, i see this:
image

so that did not seem to work…but the data is in the log…
can anyone point out what i am doing wrong?
thanks in advance

5

That is the format I have in my subject line and it works just fine… What version of Graylog are you on? The only difference I can see is mine does not have spaces. Here it is verbatim:

ALERT: ${foreach backlog message}${message.fields.details_event}${end}
6

hi, i am running a new install of 4.2.8. I have cut/pasted your example and substituted like so:

ALERT: ${foreach backlog message}${message.fields.winlogbeat_winlog_event_data_TargetUserName}${end}

i don;t see a difference, but i am hoping this will work, i am waiting for the event to occur for a test.

is there something “special” about the variable that it needs to be treated differently? I have been doing a lot of searching, i see in some posts people use $$ instead of $…do you know why?

thanks

7

so, it did not take long and this did not work…

image
after the word ALERT, should be the value in targetuser

ugg!

8

ug, ok, i figured out my issue, i missed this step in creating the event. I had the number of backlog messages set to 0, so …of course… there were no messages to pull variables from

image
image726×535 22.6 KB

thanks for everyones help

1 Like
9

Great! Thanks for posting a solution for future searchers! :smiley:

10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.