How to define custom field on Event Definition

[stanley.chen]

Dear all：
I want to define custom fields on Event Definition like below show
But when I got the alert & event , it didn’t show any custome fields.
I already test , just two custom fields can be use.
(1) {source.user} (2) {source.srcip}

others fields I define with {source.XXXX} can't be use. I already check my streams , it has fields inside . But I still can't use {source.}…
Can someone show me how to add custom field ?
Thanks!
P.S. My Graylog server version is the latest version 3.3 …

[shoothub]

Check my previous post in the past:

Notification Alert body text

You have to setup number of backlog to 1: in Alerts - Event Definitions - tab Notifications and field Message Backlog, tick the checkbox and set 1. Message backlog define number of messages to be included in Notifications. Source in default template for notification use {event.source}, which is source of event, not a source device. If you want device source included in notification message use: ${foreach backlog message}${message.source}${end} If you want to use user field (for example: src…

[stanley.chen]

Thanks for your reply…
Good job…
But I think , could you provide the pictures to show your solution?
The pictures provide more powerful effect to teach us how to setup the alert mail.

Please~~~~~~~~~~~~~~~

[jan (Jan Doberstein)]

you might want to check the alerting by example part in the docs:

https://docs.graylog.org/en/3.3/pages/alerting/alerting-by-example.html

[stanley.chen]

Thanks for your reply.
I already tried and follow this sop ,but can’t fix my problem.
This sample is the general sample to setup the alert mail…etc.
But I want to suggest official provide more example with pictures show more customized mail alert step by step…

I real real like graplog server be my company’s log server.
So I need more introduction of graylog server with pictures to finish basic function…

Thanks…