# I can't see any properly graylog alert messages **URL:** \ **Category:** Graylog Add-ons\ **Tags:** sidecar, winlogbeat\ **Created:** [March 25, 2020, 10:39am UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636 "2020-03-25T10:39:02Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mvatansever](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mvatansever/32/6059_2.png) [@mvatansever](https://community.graylog.org/u/mvatansever)\ **Post date:** [March 25, 2020, 10:39am UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636/1 "2020-03-25T10:39:03Z")
Hello, I am using to Graylog version 3.2.4 and i can’t see properly graylog alert messages. I created a stream for an example 4724 event ID, and I use the email alarm table for this, but I need some data for example “Who did it:” or “Which user”. — [Event Definition] --------------------------- Title: {event\_definition\_title} Description: {event\_definition\_description} Type: {event\_definition\_type} — [Event] -------------------------------------- Timestamp: {event.timestamp} Message: {event.message} Source: {event.source} Key: {event.key} Priority: {event.priority} Alert: {event.alert} Timestamp Processing: {event.timestamp} Timerange Start: {event.timerange\_start} Timerange End: {event.timerange\_end} User: {winlogbeat\_event\_data\_TargetUserName} Fields: {foreach event.fields field} {field.key}: {field.value} {end} {if backlog} — [Backlog] ------------------------------------ Last messages accounting for this alert: {foreach backlog message} {message} {end} {end} ![log](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/16f9fe46f5d98fa8940a74c5f33ffa07ee7bef27.png) ![stream](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/b930f353760e98fdd4026bd79e61110ba16a3ae3.png) ![teams](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f1fde70b85e6937fcd3a85dfc549037c7164296f.png) ![slack](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/de8a5d90f4de79bff019195da95af26b2427faa8.png) ![mail](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/8e41282d3c9a3680a5bb2437e7a1834574f753f5.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [March 25, 2020, 12:14pm UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636/2 "2020-03-25T12:14:56Z")
You haven’t included any messages in the backlog for your alert. Message fields (such as `winlogbeat_event_data_TargetUserName`) are only available by iterating over the backlog. See the following documentation: [https://docs.graylog.org/en/3.2/pages/alerts.html#email-alert-notification](https://docs.graylog.org/en/3.2/pages/alerts.html#email-alert-notification) In order to access the field values, you will need to write your notification template to include lines like the below: `${message.fields.winlogbeat_event_data_TargetUserName}` Remember, the above will only work while iterating over the backlog and you must include at least one message in the backlog otherwise there will be no data. ---
**Author:** ![mvatansever](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mvatansever/32/6059_2.png) [@mvatansever](https://community.graylog.org/u/mvatansever)\ **Post date:** [March 26, 2020, 7:20am UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636/4 "2020-03-26T07:20:59Z")
nothing has changed. — [Event Definition] --------------------------- Title: {event\_definition\_title} Description: {event\_definition\_description} Type: {event\_definition\_type} --- [Event] -------------------------------------- User: {message.fields.winlogbeat\_event\_data\_TargetUserName} Timestamp: {event.timestamp} Message: {event.message} Source: {event.source} Key: {event.key} Priority: {event.priority} Alert: {event.alert} Timestamp Processing: {event.timestamp} Timerange Start: {event.timerange\_start} Timerange End: {event.timerange\_end} Fields: {foreach event.fields field} {field.key}: {field.value} {end} {if backlog} — [Backlog] ------------------------------------ Last messages accounting for this alert: {foreach backlog message} {message} {end} {end} ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [March 26, 2020, 8:58am UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636/5 "2020-03-26T08:58:47Z")
You need to provide more information. All I can say from what you have posted is that you have ignored the documentation where it specifically states that message fields are only available while iterating over the backlog. The line `User: {message.fields.winlogbeat_event_data_TargetUserName}` will never work in that configuration. ---
**Author:** ![mvatansever](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mvatansever/32/6059_2.png) [@mvatansever](https://community.graylog.org/u/mvatansever)\ **Post date:** [March 26, 2020, 10:27am UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636/6 "2020-03-26T10:27:20Z")
I’ve been using version 2.3 before and I share the mail template. Now i using the v3.4 but i cant see any log email message. thank you for your help ![Event_Definitions_1](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d319cbfca5c9b1cc5bdcbf3f4796581b07c62763.png) ![Event_Definitions_2](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a53e80dbd4394a7f700126940ec52bd63ae44f3a.png) ![Event_Definitions_3](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f58af72588f4184761aea854b278bd93c16fa2df.png) ![Event_Definitions_4](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/9b59f8a2043dddca97d1c560db161ceb43f15298.png) ![Event_Definitions_5](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/dd32bd1cca2f144f3cb47137edcbf687be290bc0.png) ![Notifications](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5af04ac043519cc6834c4508c78565668046cef9.png) ![old_message_template](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/bff65557a5aea4e6cfae3a091591462153ae50b7.png) ![stream](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4112198c02c15e879f795f6c613eaff165d7706e.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [March 26, 2020, 10:29am UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636/7 "2020-03-26T10:29:14Z")
In the notification tab of your event definition, you have to add a message backlog to the event. ---
**Author:** ![mvatansever](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/mvatansever/32/6059_2.png) [@mvatansever](https://community.graylog.org/u/mvatansever)\ **Post date:** [March 26, 2020, 2:23pm UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636/8 "2020-03-26T14:23:54Z")
Ok its solved. Thank you. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [April 9, 2020, 2:23pm UTC](https://community.graylog.org/t/i-cant-see-any-properly-graylog-alert-messages/14636/9 "2020-04-09T14:23:57Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.