Include Fields In Email Callback

Graylog Central (peer support)
1

Below is my email callback config, for the most part is the standard email callback. I do however want to include the fields:
${message.fields.EventID}
${message.fields.TargetUserName}
${message.fields.SubjectUserName}

When I get an alert, I see everything else, but where these three fields are positioned, I just see blank spaces in the email callback. So how do I get the values from these fields to show up in the email callback.

cheers,

G

body:

##########
Alert Description: ${check_result.resultDescription}

Date: ${check_result.triggeredAt}

Stream ID: ${stream.id}

Stream title: ${stream.title}

Stream description: ${stream.description}

Alert Condition Title: ${alertCondition.title}

${if stream_url}Stream URL: ${stream_url}${end}

${message.fields.EventID}

${message.fields.TargetUserName}

${message.fields.SubjectUserName}

Triggered condition: ${check_result.triggeredCondition}
##########

${if backlog}Last messages accounting for this alert:

${foreach backlog message}${message}

${end}${else}
${end}
email_receivers: EMAIL@EMAIL.COM

sender: EMAIL@EMAIL.COM
subject: Graylog alert for stream: ${stream.title}: ${check_result.resultDescription}
user_receivers:

2

As you can read in http://docs.graylog.org/en/2.3/pages/streams/alerts.html#email-alert-notification, the Graylog alerts always contain a collection of messages (in the backlog variable available in templates) which you have to iterate over to get details of each message.

There is no singular message in the Graylog alerts which is why you cannot access a message variable in the template but have to iterate over backlog.

3

Hey @GTownson,

the message object is located inside the backlog object. This is why your ${message.fields.EventID} above the rows of # does not work. You would have to enclose your fields in a loop on the backlog object

For example do this:

##########
Alert Description: ${check_result.resultDescription}

Date: ${check_result.triggeredAt}

Stream ID: ${stream.id}

Stream title: ${stream.title}

Stream description: ${stream.description}

Alert Condition Title: ${alertCondition.title}

{if stream_url}Stream URL: {stream_url}${end}

${if backlog}{foreach backlog message}
${message.fields.EventID}
${message.fields.TargetUserName}
${message.fields.SubjectUserName}
{end}{else}
${end}

Triggered condition: ${check_result.triggeredCondition}
##########

${if backlog}Last messages accounting for this alert:

{foreach backlog message}{message}

{end}{else}
${end}

Greetings - Phil

4

Cheers for the reply, worked perfectly!

G

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.