### Author:  [@DodgeCamaro](https://community.graylog.org/u/DodgeCamaro)
#### Post date: [September 11, 2017, 7:05pm UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/1 "2017-09-11T19:05:31Z")
I create alerts with this [topic](http://docs.graylog.org/en/2.3/pages/getting_started/stream_alerts.html?highlight=alerted)
But I dont understand why some information dont send. Like this variable ${message.fields.name} and another similar.
This is my Conditions
I used this template
```
Date: ${check_result.triggeredAt}
Stream ID: ${stream.id}
Stream title: ${stream.title}
${if stream_url}Stream URL: ${stream_url}${end}
${if backlog}Last messages accounting for this alert:
${foreach backlog message}
Message: ${message.message}
Source: ${message.source}
Full Message: ${message.fields.full_message}
${end}${else}
${end}
```
And have this in my mail
```
##########
Alert Description: Dummy alert to test notifications
Date: 2017-09-11T18:48:33.664Z
Stream ID: 59b695542ab79c0001554b85
Stream title: New Stream
Stream description: Test notifications
Alert Condition Title: Test Alert
Stream URL: https://mysite
Triggered condition: d91e0fa5-867c-4cf1-bf0e-2b5d2fdd19f9:dummy={Dummy alert to test notifications}, stream:={59b695542ab79c0001554b85: "New Stream"}
##########
Message:
Full Message:
```
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [September 11, 2017, 7:44pm UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/2 "2017-09-11T19:44:46Z")
Have you configured the alert to actually include some message backlog?
[http://docs.graylog.org/en/2.3/pages/getting\_started/stream\_alerts.html#create-the-alert](http://docs.graylog.org/en/2.3/pages/getting_started/stream_alerts.html#create-the-alert)
---
### Author:  [@DodgeCamaro](https://community.graylog.org/u/DodgeCamaro)
#### Post date: [September 11, 2017, 8:14pm UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/3 "2017-09-11T20:14:26Z")
@jochen I set up according to this link.
What information do you need?
---
### Author:  [@DodgeCamaro](https://community.graylog.org/u/DodgeCamaro)
#### Post date: [September 12, 2017, 8:32am UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/4 "2017-09-12T08:32:55Z")
Help me in this problem, please!
---
### Author:  [@DodgeCamaro](https://community.graylog.org/u/DodgeCamaro)
#### Post date: [September 12, 2017, 11:58am UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/5 "2017-09-12T11:58:09Z")
@jan I tried everything, but dont take positive effect.
I iterate with foreach and dont have any information in my mail.
Created new streams, index set, condition and notifications.
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [September 12, 2017, 3:17pm UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/7 "2017-09-12T15:17:06Z")
What version of Graylog are you using?
Are you sure that your template is being used? Even if the `message` variable was empty, it should at least show the "Source: " line (just like "Message: " and "Full Message: ").
---
### Author:  [@DodgeCamaro](https://community.graylog.org/u/DodgeCamaro)
#### Post date: [September 12, 2017, 4:41pm UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/8 "2017-09-12T16:41:15Z")
I use such versions of applications in docker-compose:
1. Graylog 2.3.1+9f2c6ef on baec6bf2ca74 (Oracle Corporation 1.8.0\_141 on Linux 4.4.0-1022-aws)
2. Elasticsearch 5.5.1
3. MongoDB 3
4. Nginx:latest
I dont know, how templates used.
Maybe I used the wrong letter for an example.
---
### Author:  [@DodgeCamaro](https://community.graylog.org/u/DodgeCamaro)
#### Post date: [September 14, 2017, 10:47am UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/9 "2017-09-14T10:47:24Z")
@jochen Need more information?
---
### Author:  [@DodgeCamaro](https://community.graylog.org/u/DodgeCamaro)
#### Post date: [September 17, 2017, 12:13pm UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/10 "2017-09-17T12:13:18Z")
@jochen Please answer on my question.
Full infirmation about problem you can find in GitHub [Issues](https://github.com/Graylog2/graylog2-server/issues/4158)
**Full info about problem**
## Expected Behavior
When a request comes, the mail should receive a notification with short information provided by the user.
Format message:
```
You have a new request
Date: 2017-09-14T18:54:23.671Z
Firstname: Jack
Lastname: Black
Phone: +12345678900
Site page: https://site.com/example/page
IP-adress: 000.00.00.00
```
I propose to create a separate tab with variables for their customization and call it “Varibles” with the items “Global” and “Local”. “Global” for Inputs, and “Local” for the cluster Graylog.
## Current Behavior
I have this alerts
#
```
Alert Description: Stream received messages matching (Current grace time: 0 minutes)
Date: 2017-09-14T18:13:14.226Z
Stream ID: 59b92df92ab79c0001201034
Stream title: New Stream
Stream description: Maybe
Alert Condition Title: Condition_test
Stream URL: Please configure 'transport_email_web_interface_url' in your Graylog configuration file.
Triggered condition: a33229ec-cc9a-4577-84dd-0a58cc310de4:field_content_value={field: user, value: Black, grace: 0, repeat notifications: false}, stream:={59b92df92ab79c0001201034: "New Stream"}
##########
Last messages accounting for this alert:
```
Or this
```
##########
Alert Description: Dummy alert to test notifications
Date: 2017-09-14T18:18:34.009Z
Stream ID: 59b92df92ab79c0001201034
Stream title: New Stream
Stream description: Maybe
Alert Condition Title: Test Alert
Stream URL: Please configure 'transport_email_web_interface_url' in your Graylog configuration file.
Triggered condition: 5b28ae34-ef36-4600-860d-64b576301d65:dummy={Dummy alert to test notifications}, stream:={59b92df92ab79c0001201034: "New Stream"}
##########
```
I want take information an example that is written in “Expected Behavior”
```
You have a new request
Date: 2017-09-14T18:54:23.671Z
Firstname: Jack
Lastname: Black
Phone: +12345678900
Site page: https://site.com/example/page
IP-adress: 000.00.00.00
```
## Steps to Reproduce (for bugs)
1. Edit graylog.conf
password\_secret = secretpass
root\_password\_sha2 = secretpasssha2
root\_email = [mail@mail.com](mailto:mail@mail.com)
root\_timezone = Europe/Kiev
rest\_listen\_uri = [https://0.0.0.0:9000/api/](https://0.0.0.0:9000/api/)
web\_listen\_uri = [https://0.0.0.0:9000/](https://0.0.0.0:9000/)
elasticsearch\_hosts = [http://elasticsearch:9200](http://elasticsearch:9200)
elasticsearch\_compression\_enabled = true
transport\_email\_enabled = true
transport\_email\_hostname = [smtp.gmail.com](http://smtp.gmail.com)
transport\_email\_port = 465
transport\_email\_use\_auth = true
transport\_email\_use\_tls = true
transport\_email\_use\_ssl = true
transport\_email\_auth\_username = [mail@mail.com](mailto:mail@mail.com)
transport\_email\_auth\_password = password
transport\_email\_subject\_prefix = [graylog]
transport\_email\_from\_email = [graylog@example.com](mailto:graylog@example.com)
transport\_email\_web\_interface\_url = [https://site.com](https://site.com)
2. Create nginx.conf
user nginx;
worker\_processes 1;
3. Create certificate in letsencrypt1
4. docker-compose up -d
## docker-compose.yml
```
version: '2'
services:
proxy:
image: nginx
container_name: proxy
ports:
- 80:80
- 443:443
volumes:
- ./proxy/nginx.conf:/etc/nginx/nginx.conf
- /etc/letsencrypt/live/site.com/privkey.pem:/etc/ssl/private/privkey.pem
- /etc/letsencrypt/live/site.com/fullchain.pem:/etc/ssl/private/fullchain.pem
- /etc/letsencrypt/live/site.com/chain.pem:/etc/ssl/private/chain.pem
- ./proxy/ssl/dhparam.pem:/etc/pki/nginx/dhparam.pem
depends_on:
- graylog
mem_limit: 1g
networks:
- graylog
mongodb:
image: mongo:3
container_name: mongo
volumes:
- /db:/data/db
mem_limit: 2g
restart: always
networks:
- graylog
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:5.5.1
container_name: elasticsearch
volumes:
- es_data:/usr/share/elasticsearch/data
environment:
- http.host=0.0.0.0
- transport.host=localhost
- network.host=0.0.0.0
# Disable X-Pack security: https://www.elastic.co/guide/en/elasticsearch/reference/5.5/security-settings.html#general-security-settings
- xpack.security.enabled=false
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
ulimits:
memlock:
soft: -1
hard: -1
mem_limit: 1g
restart: always
networks:
- graylog
graylog:
image: graylog/graylog:latest
container_name: graylog
volumes:
- ./graylog/config:/usr/share/graylog/data/config
- graylog_journal:/usr/share/graylog/data/journal
environment:
- GRAYLOG_PASSWORD_SECRET=secretpass
- GRAYLOG_ROOT_PASSWORD_SHA2=sha2secretpass
- GRAYLOG_WEB_ENDPOINT_URI=https://site.com/api
links:
- mongodb:mongo
- elasticsearch
depends_on:
- mongodb
- elasticsearch
mem_limit: 2g
restart: always
networks:
- graylog
volumes:
es_data:
driver: local
graylog_journal:
driver: local
networks:
graylog:
driver: bridge
```
1. Create Stream and add Stream Rules with this option
`Field source must contain https://`
2. Create Global Inputs GELF HTTP with default settings, on port 12201
3. Create Conditions
`Configuration: Alert is triggered when messages matching are received. Grace period: 0 minutes. Including last message in alert notification. Configured to repeat notifications.`
4. Create Notifications
5. Send information in JSON from site to Graylog.
{
“version”: “1.1”,
“full\_message”: {“data”: “message data”},
“host”: “[https://example.com](https://example.com)”,
“short\_message”: “uid”,
"\_email": "j.doe@eample.com",
"\_step": “step\_1”,
"\_status": “success”,
"\_agent": “empty”
}
## Context
I want to get the function that is in the greylogue out of the box.
I spent a lot of time looking for a solution to this problem, but I did not find it.
## Your Environment
**Graylog Version** : v2.3.1+9f2c6ef
**Elasticsearch Version** : v. 5.5.1
**MongoDB Version** : v. 3.4.8
**Browser version** : Google Chrome 61.0.3163.91
**Operating System** : Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-1022-aws x86\_64)
**Cluster in Docker container** :
**Docker-compose Version** : 1.13.0, build 1719ceb
**Docker Version** : 17.05.0-ce, build 89658be
**Nginx Version** : latest
---
### Author:  [@jochen](https://community.graylog.org/u/jochen)
#### Post date: [September 17, 2017, 1:33pm UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/11 "2017-09-17T13:33:25Z")
> [@DodgeCamaro](#):
>
> ```auto
> {if backlog}Last messages accounting for this alert:
> {foreach backlog message.fields}${message.fields.status}
>
> ```
That’s not how the templating works. The `backlog` variable contains a collection of message objects which you have to iterate over.
Please take a look at the documentation as mentioned before:
- [http://docs.graylog.org/en/2.3/pages/streams/alerts.html#email-alert-notification](http://docs.graylog.org/en/2.3/pages/streams/alerts.html#email-alert-notification)
- [Java Minimal Template Engine](https://cdn.rawgit.com/DJCordhose/jmte/master/doc/index.html)
Example:
```auto
{if backlog}
Last messages accounting for this alert:
{foreach backlog message}
Status: ${message.fields.status}
{end}
{else}
Empty backlog
${end}
```
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [October 1, 2017, 1:33pm UTC](https://community.graylog.org/t/problem-with-create-alerts/2411/12 "2017-10-01T13:33:58Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.