HTTP Notification Variable in URL

Graylog Central (peer support)
1

Hello,

I’m super new to Graylog, but I can’t seem to find a solution.

We want to trigger Oxidized to take a new backup when a certain syslog hits Graylog. The URL to trigger Oxidized is:

http://oxidized.domain.com/node/next/HOSTNAME

I can get the hostname from the syslog entry, but I can’t for the life of me add the hostname to the URL in a custom HTTP Notification.

I’ve tried ${message.cli_hostname} (cli_hostname) is the field in the message.
Tried ${source.cli_hostname}

I also tried creating a field in the Event configuration named CLI_Hostname and tried extracting those two fields. Nothing worked. Oxidized see’s the literal text, instead of the hostname.

Here’s the URL in the Notification:

http://oxidized.domain.com:8888/node/next/${CLI_Hostname}

Here’s the error from Oxidized:

2024-12-04 21:20:22 - Oxidized::NodeNotFound - unable to find ‘${CLI_Hostname}’:

Is there a way to pass a field into a URL in a custom HTTP Notification?

We’re running Graylog 6.1.3 in Docker.

Thanks
Tyler

2

your custom fields in the event need to be read from the message using the format ${source.field_name}, then to use that in a notification you need to use the format ${event.fields.custom_field_name}

3

Hi Joel,

For some reason that didn’t seem to work. Am I capturing the field correctly in the event?

Graylog-Fields
Graylog-Fields581×324 19.4 KB

Here’s the updated error in Oxidized:

> 2024-12-05 16:20:14 - Oxidized::NodeNotFound - unable to find '${event.fields.CLI_Hostname}':

4

It looks like the field is getting populated properly, but the notification doesn’t use the value in the URL.

Event-Fields
Event-Fields298×148 10.1 KB

My notification URL is now:
http://oxidized.domain.com:8888/node/next/${event.fields.CLI_Hostname}

Tyler

5

My first guess it uppercase lowercase in your setup, i think it matters.

6

Wait nevermind, thats not it, let me look again.

7

Thank you for your help! Yes, it’s still not working. Are variables able to be used in the URL on an HTTP notification?

Notification-URL
Notification-URL493×103 9.08 KB

I changed the event field to “devicename”. All lowercase and removed the underscore.

Still no go:

2024-12-05 17:03:15 - Oxidized::NodeNotFound - unable to find ‘${event.fields.devicename}’:

8

Are you using the classic “http notification” or the new “custom http notification”?

9

The Custom HTTP notification because I need to do a GET on that URL instead of a POST.

10

I dont think that the url field goes through the template engine, so variables only work in the body unfortunatly.

11

Darn. Well thank you for investigating and letting me know!

Cheers