# How to I get extra fields in my E-Mail Notifications?
**URL:** https://community.graylog.org/t/how-to-i-get-extra-fields-in-my-e-mail-notifications/23345
**Category:** Graylog Central (peer support)
**Tags:** basic-configuration, alert
**Created:** [April 8, 2022, 9:26pm UTC](https://community.graylog.org/t/how-to-i-get-extra-fields-in-my-e-mail-notifications/23345 "2022-04-08T21:26:12Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Gamienator](https://community.graylog.org/u/Gamienator)
#### Post date: [April 8, 2022, 9:26pm UTC](https://community.graylog.org/t/how-to-i-get-extra-fields-in-my-e-mail-notifications/23345/1 "2022-04-08T21:26:12Z")
Hey everyone,
sorry for another tpoic, but I guess on the first setup is the most new stuff and for some reason my typical try and error almost never work here 😅 I’m really sorry to bug you all the time.
My next issue are alerts. Setting it up that way, that as soon as I got a successful login via SSH on any on my servers, I’ll get an E-Mail notification. Which works okay, but I would LOVE to have an extra Field with like Client IP, Username etc.
ATM my Mail looks like this:
So as you can see, I already figured out to add an backlog, and how to “Add” a field. But for some reason none of my data is pulled into that ☹
My last try to get the Data is:
What is the missing part in this puzzle? ☹
Thanks in advance!
Cheers,
Gamie
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [April 8, 2022, 10:47pm UTC](https://community.graylog.org/t/how-to-i-get-extra-fields-in-my-e-mail-notifications/23345/2 "2022-04-08T22:47:46Z")
Hello @Gamienator
To help you further can wee see the whole Notification template? Specially the **Body Template** part.
---
### Author:  [@Gamienator](https://community.graylog.org/u/Gamienator)
#### Post date: [April 9, 2022, 6:45am UTC](https://community.graylog.org/t/how-to-i-get-extra-fields-in-my-e-mail-notifications/23345/3 "2022-04-09T06:45:38Z")
Hey there,
sure:
```auto
--- [Event Definition] ---------------------------
Title: ${event_definition_title}
Description: ${event_definition_description}
Type: ${event_definition_type}
--- [Event] --------------------------------------
Timestamp: ${event.timestamp}
Message: ${event.message}
Source: ${event.source}
Key: ${event.key}
Priority: ${event.priority}
Alert: ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start: ${event.timerange_start}
Timerange End: ${event.timerange_end}
Fields:
${foreach event.fields field} ${field.key}: ${field.value}
${end}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
${end}
${end}
```
I expected hat if I add this fields they will be added in the template:
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [April 11, 2022, 9:59pm UTC](https://community.graylog.org/t/how-to-i-get-extra-fields-in-my-e-mail-notifications/23345/4 "2022-04-11T21:59:11Z")
Hello @Gamienator
To get an extra field/s in the notification you would need to adjust your Notification template.
If I can direct you to this part of the Notification template.
```auto
Fields:
${foreach event.fields field} ${field.key}: ${field.value}
${end}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
${end}
```
Below is a demo for extra fields and full message. Please take note of the macros that are used.
```auto
Fields:
${foreach event.fields field} ${field.key}: ${field.value}
${end}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
TargetUserName: ${message.fields.TargetUserName}
WorkstationName: ${message.fields.WorkstationName}
EventReceivedTime: ${message.fields.EventReceivedTime}
Source: ${message.fields.source}
Message Link: https://Graylog.domain.com:9000/messages/${message.index}/${message.id}
${end}
```
> **Click me**
>
> ```auto
> ### This is the Full Template ###
> --- [Event Definition] ---------------------------
> Title: ${event_definition_title}
> Description: ${event_definition_description}
> Type: ${event_definition_type}
> --- [Event] --------------------------------------
> Timestamp: ${event.timestamp}
> Message: ${event.message}
> Source: ${event.source}
> Key: ${event.key}
> Priority: ${event.priority}
> Alert: ${event.alert}
> Timestamp Processing: ${event.timestamp}
> Timerange Start: ${event.timerange_start}
> Timerange End: ${event.timerange_end}
> Fields:
> ${foreach event.fields field} ${field.key}: ${field.value}
> ${end}
> ${if backlog}
> --- [Backlog] ------------------------------------
> Last messages accounting for this alert:
> ${foreach backlog message}
> ${message}
> TargetUserName: ${message.fields.TargetUserName}
> WorkstationName: ${message.fields.WorkstationName}
> EventReceivedTime: ${message.fields.EventReceivedTime}
> Source: ${message.fields.source}
> Message Link: https://Graylog.domain.com:9000/messages/${message.index}/${message.id}
> ${end}
> ${end}
>
> ```
To sum it up;
The full message `${message}` and then what follows is **TargetUserName** , **WorkstationName** , **EventReceivedTime** , **Source** , and **message link**.
If the fields are in the message/logs you can grab anyone you want.
So for starters, you need to add **message** and **fields** then the field you would like
Example, should be something like this.
` ${message.fields.some_field}`
Message link is nice to have also, the first part is you URL for Graylog Server then add `/${message.index}` and `/${message.id}` to the end. It would direct you to the message that was triggered from your email notification.
Example.
`Message Link: https://Graylog.domain.com:9000/messages/${message.index}/${message.id}`
**Part #2**
If you using HTML in the email you now need to configure your _HTML Body Template_ which is below the _Body Template_. You have two choices, either remove the configuration of the _HTML Body Template_ or configure it.
If you decide to configure it then from the example above you would need to configure this section
```auto
${if backlog}
| Backlog (Last messages accounting for this alert) |
|---|
${foreach backlog message}
| ${message} |
${end}
${end}
```
Example from the demo Notification template above. I would need to add something like this as shown below.
```auto
${if backlog}
| Backlog (Last messages accounting for this alert) |
|---|
${foreach backlog message}
| ${message} |
| TargetUserName: ${message.fields.TargetUserName} |
| WorkstationName: ${message.fields.WorkstationName} |
| EventReceivedTime: ${message.fields.EventReceivedTime} |
| Source: ${message.fields.source} |
| Message Link: https://Graylog.domain.com:9000/messages/${message.index}/${message.id} |
${end}
${end}
```
Hope that helps
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [April 25, 2022, 9:59pm UTC](https://community.graylog.org/t/how-to-i-get-extra-fields-in-my-e-mail-notifications/23345/5 "2022-04-25T21:59:54Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.