Notifications don't contain data

I use Graylog 4.3, because of I can’t use MongoDB 5, because of CPU doesn’t support AVX.

Notifications don’t contain data.

For example this syslog event:

Send this notification (there is only one message during this time):
[here should be image, but as new user I can’t upload, so I paste raw text]

Event Definition
Title	Errors
Type	aggregation-v1

Timestamp	2023-11-12T11:35:06.296Z
Message	Errors
Source	server
Priority	3
Alert	true
Timestamp Processing	2023-11-12T11:35:06.296Z
Timerange Start	
Timerange End	
Source Streams	000000000000000000000001

which is not helpful at all. I don’t even have source “server”.

I use default template for notifications. Bellow Email Body

--- [Event Definition] ---------------------------
Title:       ${event_definition_title}
Description: ${event_definition_description}
Type:        ${event_definition_type}
--- [Event] --------------------------------------
Timestamp:            ${event.timestamp}
Message:              ${event.message}
Source:               ${event.source}
Key:                  ${event.key}
Priority:             ${event.priority}
Alert:                ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start:      ${event.timerange_start}
Timerange End:        ${event.timerange_end}
${foreach event.fields field}  ${field.key}: ${field.value}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}

Why? How to fix? Any way to add link to graylog to event?

Hi @kwladyka

Struggled with that to, our defenition looks like this at the end:

${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
https://<graylog server (ip)addres>:9000/messages/${message.index}/${}

and the HTML body template looks like this at the end:

${if backlog}
<br /><table width="100%" border="0" cellpadding="10" cellspacing="0" style="background-color:#f9f9f9;border:none;line-height:1.2"><tbody>
<tr><th style="background-color:#e6e6e6;line-height:1.5">Backlog (Last messages accounting for this alert)</th></tr>
${foreach backlog message}
<tr><td>http://<graylog server (ip)addres>:9000/messages/${message.index}/${}</td></tr>

Good luck :slight_smile:

Kind greetings,

1 Like

I have tried it, but it still I don’t see any fields or message.

Hi @kwladyka

In the event defenition at the section Notifications is Message backlog checked?


1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.