Notification Alert body text

[kcarter (Ken)]

I’m new to Graylog and am evaluating it for possible purchase. I’ve set up 4 notifications all for Windows user account changes. The problem is that the alert email does not show me who created/altered the account or what account was created/altered. I’ve searched google and the documentation for the answers and can not find anything. Also the source always shows as Graylog instead of the actual source of the Windows event.

Body template
— [Event Definition] ---------------------------
Title: {event_definition_title} Description: {event_definition_description}
Type: {event_definition_type} --- [Event] -------------------------------------- Timestamp: {event.timestamp}
Message: {event.message} Source: {event.source}
Key: {event.key} Priority: {event.priority}
Alert: {event.alert} Timestamp Processing: {event.timestamp}
Timerange Start: {event.timerange_start} Timerange End: {event.timerange_end}
Fields:
{foreach event.fields field} {field.key}: {field.value} {end}
{if backlog} --- [Backlog] ------------------------------------ Last messages accounting for this alert: {foreach backlog message}
{message} {end}
${end}

[shoothub]

You have to setup number of backlog to 1: in Alerts - Event Definitions - tab Notifications and field Message Backlog, tick the checkbox and set 1.

Message backlog define number of messages to be included in Notifications.

Source in default template for notification use {event.source}, which is source of event, not a source device.

If you want device source included in notification message use:
${foreach backlog message}${message.source}${end}

If you want to use user field (for example: src_ip) use {$message.fields.src_ip}:
${foreach backlog message}${message.fields.src_ip}${end}

For example I use this message text after somebody connect to switch:
{foreach backlog message} Source device: {message.source} Username: {message.fields.username} IP: {message.fields.src_ip} ${end}

You can also use same technique in message subject, for example I use this:
User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}

Hope it helps.

[kcarter (Ken)]

Thank you, I will try it out.

[kcarter (Ken)]

That will do. Thank you for your assistance.