How to send selected field only with graylog Alert Notification

[LinuxLover (Kashif)]

Hi,
We are implemented Graylog server for Windows Logs.
From Client sides ( Windows Machines ) send logs to Graylog using nxlog client
using GELF_UDP

Graylog Server version is 6.

We want to configure the Alert email in case there is Failed user login/password attempt ( By using Windows Event ID 4625 ).

Alert is working and it is triggering notification. The issue is that we want only selected Field of Alert to incldue in notifcation email. I tried to use below way

Custom notification variables

You have to setup number of backlog to 1: in Alerts - Event Definitions - tab Notifications and field Message Backlog , tick the checkbox and set 1. Message backlog define number of messages to be included in Notifications. Source in default template for notification use {event.source}, which is source of event, not a source device. If you want device source included in notification message use: ${foreach backlog message}${message.source}${end} If you want to use user field (for example: s…

It is sending cmplete log.

Below is configuration I am trying to use

${if backlog}
— [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
User: ${message.fields.TargetUserName}
${end}
${end}

[LinuxLover (Kashif)]

I am able to figure out the issue.

Actually I need to make the changes Email HTML Body section.
Before I was making previous mentioned changes in Email body (Plain)

My client was receiving the email in HTML format.