Loop over backlog in Notification body

[frantz]

Hello,

I try to get a notification like:
{“src_ip”: [“1.1.1.1”, “2.2.2.2”, “3.3.3.3”], “dest_ip”: [“1.2.3.4”]}

I try to loop over backlog but I have 2 issues:

Firstly we can only loop over logs (messages) and not on a specific field.
For example I can’t loop over src_ip, I could only get something like {“messages”: [{“src_ip”: “1.1.1.1”, “dest_ip”: “1.2.3.4”}, {“src_ip”: “2.2.2.2”, “dest_ip”: “1.2.3.4”}]}
I would expect to loop as:
{“src_ip”: ${foreach backlog.message.fields.src_ip ip}"${ip}"${end}, }

Secondly I can’t remove the last coma in a loop.
${if backlog}{“messages”: [${foreach backlog message}{“src_ip”: ${message.fields.src_ip}${end}, ]}${end}
It would produce something like:
{“messages”: [{“src_ip”: “1.1.1.1”}, {“src_ip”: “2.2.2.2”}, ]}
You notice the last coma breaking the JSON format.

Do I miss something ?
I don’t find any documentaion on the notification language (if, foreach…)

[gsmith]

Hello,

@frantz

I don’t find any documentaion on the notification language (if, foreach…)

Perhaps something here may help.

• Alerts — Graylog 3.2.0 documentation

[frantz]

The documentation is incomplete. It only gives some examples, but it doesn’t explain the language in details.

[gsmith]

Hello,

From the documentation linked above I noticed this.

GitHub - DJCordhose/jmte

From this section here

As for how the language is explained in detail, not sure.

I might be able to give some examples but its hard to read your post above, perhaps using the markdown language would help and a example of what you trying to achieve would be great

[frantz]

Thank you for pointing to this documentation.
The page Java Minimal Template Engine explains all the possibility offered by this language.
I’m now able to fix my second issue: I can remove the last coma thanks to the special variable ${if last_item}.

So the last problem is I can’t loop over a specific field in the backlog such as:
{"src_ip": [${foreach backlog.fields.src_ip ip}"${ip}" ,${end}]}
which would produce something like:
{"src_ip": ["1.1.1.1", "2.2.2.2", "3.3.3.3"]}

Maybe something like this could work:

{
	"src_ip": [
		${foreach backlog log}
			${foreach log.fields field}
				${if field.key=src_ip}
					${if last_field}
						"${field.src_ip}"
					${else}
						"${field.src_ip}" ,
					${end}
				${end}
			${end}
		${end}
	],
	"dest_ip": [
		${foreach backlog log}
			${foreach log.fields field}
				${if field.key=dest_ip}
					${if last_field}
						"${field.dest_ip}"
					${else}
						"${field.dest_ip}" ,
					${end}
				${end}
			${end}
		${end}
	]
}

[frantz]

It’s not very efficient but it works:

{
    	"src_ip": [
    		${foreach backlog log}
    			${foreach log.fields field}
    				${if field.key=src_ip}
    					${if last_log}
    						"${field.value}"
    					${else}
    						"${field.value}" ,
    					${end}
    				${end}
    			${end}
    		${end}
    	],
    	"dest_ip": [
    		${foreach backlog log}
    			${foreach log.fields field}
    				${if field.key=dest_ip}
    					${if last_log}
    						"${field.value}"
    					${else}
    						"${field.value}", 
    					${end}
    				${end}
    			${end}
    		${end}
    	]
    }