I can't see any properly graylog alert messages

[mvatansever (MEHMET VATANSEVER)]

Hello,
I am using to Graylog version 3.2.4 and i can’t see properly graylog alert messages.
I created a stream for an example 4724 event ID, and I use the email alarm table for this, but I need some data for example “Who did it:” or “Which user”.

— [Event Definition] ---------------------------
Title: {event_definition_title} Description: {event_definition_description}
Type: {event_definition_type} — [Event] -------------------------------------- Timestamp: {event.timestamp}
Message: {event.message} Source: {event.source}
Key: {event.key} Priority: {event.priority}
Alert: {event.alert} Timestamp Processing: {event.timestamp}
Timerange Start: {event.timerange_start} Timerange End: {event.timerange_end}
User: {winlogbeat_event_data_TargetUserName} Fields: {foreach event.fields field} {field.key}: {field.value}
{end} {if backlog}
— [Backlog] ------------------------------------
Last messages accounting for this alert:
{foreach backlog message} {message}
{end} {end}

[Ponet (Jesse Hills)]

You haven’t included any messages in the backlog for your alert.

Message fields (such as winlogbeat_event_data_TargetUserName) are only available by iterating over the backlog.

See the following documentation:
https://docs.graylog.org/en/3.2/pages/alerts.html#email-alert-notification

In order to access the field values, you will need to write your notification template to include lines like the below:
${message.fields.winlogbeat_event_data_TargetUserName}

Remember, the above will only work while iterating over the backlog and you must include at least one message in the backlog otherwise there will be no data.

[mvatansever (MEHMET VATANSEVER)]

nothing has changed.

— [Event Definition] ---------------------------
Title: {event_definition_title} Description: {event_definition_description}
Type: {event_definition_type} --- [Event] -------------------------------------- User: {message.fields.winlogbeat_event_data_TargetUserName}
Timestamp: {event.timestamp} Message: {event.message}
Source: {event.source} Key: {event.key}
Priority: {event.priority} Alert: {event.alert}
Timestamp Processing: {event.timestamp} Timerange Start: {event.timerange_start}
Timerange End: {event.timerange_end} Fields: {foreach event.fields field} {field.key}: {field.value}
{end} {if backlog}
— [Backlog] ------------------------------------
Last messages accounting for this alert:
{foreach backlog message} {message}
{end} {end}

[Ponet (Jesse Hills)]

You need to provide more information.

All I can say from what you have posted is that you have ignored the documentation where it specifically states that message fields are only available while iterating over the backlog.

The line User: {message.fields.winlogbeat_event_data_TargetUserName} will never work in that configuration.

[mvatansever (MEHMET VATANSEVER)]

I’ve been using version 2.3 before and I share the mail template. Now i using the v3.4 but i cant see any log email message.
thank you for your help

[Ponet (Jesse Hills)]

In the notification tab of your event definition, you have to add a message backlog to the event.

[mvatansever (MEHMET VATANSEVER)]

Ok its solved.
Thank you.