# How to add an action to a message shown in the dashboard

**URL:** <https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803>\
**Category:** Graylog Central (peer support)\
**Tags:** dashboards\
**Created:** [June 5, 2025, 10:10am UTC](https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803 "2025-06-05T10:10:27Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![louis](https://avatars.discourse-cdn.com/v4/letter/l/ecb155/32.png) [@louis](https://community.graylog.org/u/louis)\
**Post date:** [June 5, 2025, 10:10am UTC](https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803/1 "2025-06-05T10:10:27Z")

</div>

I did setup Graylog (community edition) to monitor alarms. That works, no problem.

Then a dashboard shows a lot of messages and I would like to add a status to certain messages, like ‘further action needed’ etc. Eventually forward the event.

The IMHO strange thing is that I can only view the messages in the dashboard but not mark then for any action / give them a status and track them in an other dashboard.

How should I do that!?  
Is it really not possible!?  
Is this function removed in the community edition!!?

Note that I am running the latest GrayLog version (6.2.2)

**4. How can the community help?**

**Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab]

---

<div class="post-metadata">

**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\
**Post date:** [June 5, 2025, 10:36am UTC](https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803/2 "2025-06-05T10:36:01Z")

</div>

If your talking about the log message, no, once they are written they are read only forever.

If your talking about an alert/event, event triage (assigning, status, notes, etc) is only a feature of Graylog Security.

---

<div class="post-metadata">

**Author:** ![louis](https://avatars.discourse-cdn.com/v4/letter/l/ecb155/32.png) [@louis](https://community.graylog.org/u/louis)\
**Post date:** [June 5, 2025, 11:27am UTC](https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803/3 "2025-06-05T11:27:59Z")

</div>

I am talking about log messages as forwarded / collected by Graylog from any source. And of course the message itself should not be changeable.

However adding a status and an action is something else, which is IMHO a very logical even essential function in every alarm/message monitoring system.

So I would be very surprissed if that functionality is not available in GrayLog. I would really expect that you can select a message and have an option to set a status and create an event.

---

<div class="post-metadata">

**Author:** ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)\
**Post date:** [June 6, 2025, 9:45am UTC](https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803/4 "2025-06-06T09:45:41Z")

</div>

I think you simply want to create an event telling you, that there are a lot of logs (of some certain time). You might use the “Group by” function to split your alerts for some fields.  
If you attach an Notification to your event, this will become an alert and tell you that there is something going on. If you hit the replay button on the event-page you will be redirected to a stream-view showing you the logs which triggered that event.

---

<div class="post-metadata">

**Author:** ![louis](https://avatars.discourse-cdn.com/v4/letter/l/ecb155/32.png) [@louis](https://community.graylog.org/u/louis)\
**Post date:** [June 6, 2025, 2:30pm UTC](https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803/5 "2025-06-06T14:30:33Z")

</div>

No I think … you misunderstood my intention. I would like to add an status & an action as operator sitting in front of a dashboard.

---

<div class="post-metadata">

**Author:** ![ihe](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ihe](https://community.graylog.org/u/ihe)\
**Post date:** [June 10, 2025, 1:35pm UTC](https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803/6 "2025-06-10T13:35:27Z")

</div>

I think in that case @Joel_Duffield already gave the answer:

> [@Joel\_Duffield](#):
>
> If your talking about an alert/event, event triage (assigning, status, notes, etc) is only a feature of Graylog Security.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 24, 2025, 1:35pm UTC](https://community.graylog.org/t/how-to-add-an-action-to-a-message-shown-in-the-dashboard/35803/7 "2025-06-24T13:35:41Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
