# Notification email backlog blank despite enabled

**URL:** https://community.graylog.org/t/notification-email-backlog-blank-despite-enabled/16969
**Category:** Graylog Central (peer support)
**Created:** [August 31, 2020, 1:22am UTC](https://community.graylog.org/t/notification-email-backlog-blank-despite-enabled/16969 "2020-08-31T01:22:54Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![bbfunde](https://avatars.discourse-cdn.com/v4/letter/b/f4b2a3/32.png) [@bbfunde](https://community.graylog.org/u/bbfunde)
#### Post date: [August 31, 2020, 1:22am UTC](https://community.graylog.org/t/notification-email-backlog-blank-despite-enabled/16969/1 "2020-08-31T01:22:54Z")

</div>

Hi all,

Graylog version: v3.3.4

I can’t find the exact solution to my problem so I create a new topic, I am sorry if it is duplicated.

I want to display specific fields and its keys in the notification email so I enabled blacklog in the event setting and add the following in the blacklog section of the notification configuration:

![img2](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/618df135018f7df9098c61f8edbf28ba38a3fe8f.png)

I’ve consulted the official reference but I still don’t get the correct syntax. So I tried the following:

> (money\_sign)field\_name  
> (money\_sign){field\_name}  
> (money\_sign){message.field\_name}  
> (money\_sign){fields.field\_name}

But the email I got from this shows nothing:

 ![img1.PNG](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/ab9b054c64cca151b774705c4674e3d6f56b97db.jpeg)

I wonder what went wrong. 🤔 Please help.

Thanks a lot in advance.

---

<div class="post-metadata">

### Author: ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)
#### Post date: [August 31, 2020, 7:30am UTC](https://community.graylog.org/t/notification-email-backlog-blank-despite-enabled/16969/2 "2020-08-31T07:30:54Z")

</div>

You have to setup number of backlog to 1: in ` Alerts - Event Definitions - tab Notifications and field Message Backlog`, tick the checkbox and set 1.

_Message backlog define number of messages to be included in Notifications._

If you want device source included in notification message use:  
`${foreach backlog message}${message.source}${end}`

If you want to use user field (for example: srcip) use `{$message.fields.srcip}` :  
` ${foreach backlog message}${message.fields.src_ip}${end}`

For example I use this message text after somebody connect to switch:  
` {foreach backlog message} Source device: {message.source} Username: {message.fields.username} IP: {message.fields.srcip} ${end}`

You can also use same technique in message subject, for example I use this:  
`User ${foreach backlog message}${message.fields.username}${end} connected to switch ${foreach backlog message}${message.source}${end} from IP ${foreach backlog message}${message.fields.src_ip}${end}`

Hope it helps.

---

<div class="post-metadata">

### Author: ![bbfunde](https://avatars.discourse-cdn.com/v4/letter/b/f4b2a3/32.png) [@bbfunde](https://community.graylog.org/u/bbfunde)
#### Post date: [August 31, 2020, 11:52pm UTC](https://community.graylog.org/t/notification-email-backlog-blank-despite-enabled/16969/3 "2020-08-31T23:52:50Z")

</div>

Thank you for saving the day. 😙

I didn’t know you have to include the start and end tags for each backlog message, and that’s what I have been missing.

The ending example also very helpful, good to see you include a bonus for me.

Thanks again.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [September 14, 2020, 11:53pm UTC](https://community.graylog.org/t/notification-email-backlog-blank-despite-enabled/16969/4 "2020-09-14T23:53:02Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.