How to customize Graylog message notification subject

[shoothub]

Check my previous post, as @tmacgbay suggested:

Add the event source to the subject of an email notification

It works. If you want source field in subject, you need to use {$message.source}: ${foreach backlog message}${message.source}${end} If you want to use user field (for example: src_ip) use {$message.fields.src_ip} as @tmacgbay suggested: ${foreach backlog message}${message.fields.src_ip}${end} For example I use this subject after somebody connect to switch: User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} f…