# How to customize my backlog message?

**URL:** <https://community.graylog.org/t/how-to-customize-my-backlog-message/22979>\
**Category:** Graylog Central (peer support)\
**Tags:** alert\
**Created:** [March 10, 2022, 2:00am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979 "2022-03-10T02:00:17Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![ericwu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ericwu/32/11131_2.png) [@ericwu](https://community.graylog.org/u/ericwu)\
**Post date:** [March 10, 2022, 2:00am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/1 "2022-03-10T02:00:17Z")

</div>

Version : 4.2.7

Message Template as below :

```auto

日志報錯 : ${event_definition_title}
描述 : ${event_definition_description} 
時間 : ${event.timestamp}
內容 :
${if backlog}
${foreach backlog message}
${message}
=========================
${end}
${end}

```

My original log message as below :

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/9747c6da386209d7d04d0292bc3a981157b34580.png)

My question is :  
When I got alert from telegram, the backlog will show too many fields that I do not need.  
like this :  
fields={gl2\_accounted\_message\_size=652, level=5, gl2\_remote\_ip=10.140.0.127, gl2\_remote\_port=43884, facility\_num=1, gl2\_message\_id=01FXRRP2QS7YARCETQR5KV91CC, gl2\_source\_node=9fd0b2a9-07f8-403f-86e1-455b935157bc, gl2\_source\_input=6228707e963f950ddc47a84d, facility=user-level}, id=5addde90-a015-11ec-b866-42010a8c00c7, source=10.140.15.239, stream\_ids=[62287223963f950ddc47aaa6]}

How can I delete or modify this in backlog ?  
Any idea?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 10, 2022, 2:39am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/2 "2022-03-10T02:39:58Z")

</div>

Hello && Welcome @ericwu

To removed the backlog messages it will be this section. This all can be done on the Notification Template.

```auto
${message}

```

From here

```auto
${foreach event.fields field} ${field.key}: ${field.value}
${end}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
${end}

```

If you’re only using Body Template and depending on what fields are generated the configuration could look something like this. I have modified it to only grab what fields I wanted to see.

```auto
--- [Event Definition] ---------------------------
Title: ${event_definition_title}
Description: ${event_definition_description}
Type: ${event_definition_type}
--- [Event] --------------------------------------
Timestamp: ${event.timestamp}
Message: ${event.message}
Source: ${event.source}
Priority: ${event.priority}
Alert: ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start: ${event.timerange_start}
Timerange End: ${event.timerange_end}
Stream URL: ${event.stream_name}          
${if stream_url}Stream URL: ${stream_url}${end}

${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
User: ${message.fields.TargetUserName}
WorkStation Name: ${message.fields.WorkstationName}
Event Time: ${message.fields.EventReceivedTime}
Source: ${message.source}
Logon Type: ${message.LogonType}
---[backlog end]---------------------------------
${end}
${end}

```

> [@ericwu](#):
>
> fields={gl2\_accounted\_message\_size=652, level=5, gl2\_remote\_ip=10.140.0.127, gl2\_remote\_port=43884, facility\_num=1, gl2\_message\_id=01FXRRP2QS7YARCETQR5KV91CC, gl2\_source\_node=9fd0b2a9-07f8-403f-86e1-455b935157bc, gl2\_source\_input=6228707e963f950ddc47a84d, facility=user-level}, id=5addde90-a015-11ec-b866-42010a8c00c7, source=10.140.15.239, stream\_ids=[62287223963f950ddc47aaa6]}

The gl2\_\* can be used, I’m not sure if you have those other ones, if not you may need to create them (extractors/pipelines) or use a different format ( i.e. GELF).

---

<div class="post-metadata">

**Author:** ![ericwu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ericwu/32/11131_2.png) [@ericwu](https://community.graylog.org/u/ericwu)\
**Post date:** [March 10, 2022, 3:07am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/3 "2022-03-10T03:07:55Z")

</div>

Thanks a lot @gsmith .

so if I want delete the “gl2\_\*” section on my alert message.  
The only way is create textractors/pipelines or use a different format ?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 10, 2022, 3:16am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/4 "2022-03-10T03:16:58Z")

</div>

Hello

> [@ericwu](#):
>
> so if I want delete the “gl2\_\*” section on my alert message.

The gl2\_ \* is part of Graylog.

> [@ericwu](#):
>
> The only way is create textractors/pipelines or use a different format ?

I was referring to adding not deleting fields.

If this is just for the **email notifications** what you do is remove` ${message}` from the notification template and just add your own fields needed, should be good.

---

<div class="post-metadata">

**Author:** ![ericwu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ericwu/32/11131_2.png) [@ericwu](https://community.graylog.org/u/ericwu)\
**Post date:** [March 10, 2022, 3:36am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/5 "2022-03-10T03:36:20Z")

</div>

@gsmith  
My alert message include two section  
one is : the original log message  
two is : gl2\_\* section  
I’ve tried to remove ${message} but the telegram will show nothing.  
How can I do to only send “one” section to telegram alert ?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 10, 2022, 3:55am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/6 "2022-03-10T03:55:42Z")

</div>

Hello,

What you showed above looked like for **Email notification** not telegram. To be honest not sure what you have configured. I was suggesting to Email notification template configuration. So I assume you using something different?

> [@ericwu](#):
>
> one is : the original log message  
> two is : gl2\_\* section

I haven’t seen that before , and again I assume your talking about this template ?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/130d498d7bb274a4ed612d7f605dde91cdeb2c89.png)

Or this template?

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e1714d42b6a811ef963dfeb7ca8a9b7397a6d042.png)

---

<div class="post-metadata">

**Author:** ![ericwu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ericwu/32/11131_2.png) [@ericwu](https://community.graylog.org/u/ericwu)\
**Post date:** [March 10, 2022, 5:35am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/7 "2022-03-10T05:35:36Z")

</div>

@gsmith Thanks for your help  
Actually, I used telegram plugin for notification.  
As below :

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/666557aa9d175aa8d15cdd332d160971644a288f.png)  
I think the message template as same as the mail notification.  
Am I right ?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 10, 2022, 5:51am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/8 "2022-03-10T05:51:26Z")

</div>

Hello,

> [@ericwu](#):
>
> I used telegram plugin for notification.

Oh I understand now.

> [@ericwu](#):
>
> I think the message template as same as the mail notification.  
> Am I right ?

Some of the macros (i.e. ${message}) are the same. To be honest I haven’t used that plugin. You maybe missing some type of configuration that gets read my Telegram plugin but Im not 100% sure

Have you seen this?

- [GitHub - irgendwr/TelegramAlert: 🔔 Telegram Notification Plugin for Graylog](https://github.com/irgendwr/TelegramAlert)

What I do know is this section will send your backlog message.

```auto
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message.message}

```

Like I said I haven’t use that Plugin, but maybe someone else here has. If I have time I might be able to test this out later.

---

<div class="post-metadata">

**Author:** ![ericwu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ericwu/32/11131_2.png) [@ericwu](https://community.graylog.org/u/ericwu)\
**Post date:** [March 10, 2022, 5:54am UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/9 "2022-03-10T05:54:18Z")

</div>

@gsmith  
I am thankful for your assistance.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 10, 2022, 10:29pm UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/10 "2022-03-10T22:29:53Z")

</div>

Hello,  
I notice another member @tomasi was using Telegram, Perhaps he maybe able to help.  
He posted [here](https://community.graylog.org/t/how-to-send-event-definition-title-in-telegram-alert/22736)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 24, 2022, 10:30pm UTC](https://community.graylog.org/t/how-to-customize-my-backlog-message/22979/11 "2022-03-24T22:30:14Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.