Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic!
1. Describe your incident:
Sending a teams notification from Graylog with the built-in Teams notification type. The notification includes a MAC address, in the format aa:bb:cc:dd:ee:ff
The MAC address in the notification is ALWAYS truncated after the first colon. No matter what. It seems this is due to the way the plugin sends the message. Teams seems to treat the colon as a separator to create a table.
In fact, any colon sent to the notification gets treated this way. This is my notification template:
How can I send text in a teams notification that actually gets displayed?
2. Describe your environment:
OS Information:
Ubuntu
Package Version:
4.3.8
Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
Everything I can think of, from enclosing with quotes or backtics, to enclosing in an html <pre> tag.
This is more of a workaround rather than a solution, but perhaps you could create a pipeline rule to strip out the colons and save a new field with the MAC all jumbled together, like AABBCC112233. Then you could use that field in your alert.
However, the colon issue is more problematic, since I would need to do that with any field that has a colon. I am attempting to use lots of syslog data, and most all syslog messages have strings with colons, which would require me to do a lot of duplicate processing and storage of fields just to send a notification.
Curious why there aren’t some config options for the MS Teams notification plugins. There are many supported formats for teams notifications and cards, including plain text, which if available would solve the issue. May other open source software packages have this capability (librenms for example).
As Joel mentioned, your main issue here will not be resolved in 4.3.9. There was a timestamp issue that was related that was able to be backported, but there was no good way to fix the message backlog piece and make it stop breaking up messages by colon without a breaking change to existing Teams notifications.
Once on 5.0, you should be able to reformat your existing template to look something like this:
I will look at upgrading to v5. Good resources for a pain-free upgrade? I have a pretty simple setup… no clusters, single machine with all parts running on the same vm.