# Question: can't get the notifications altert when i set the backlog parameter

**URL:** <https://community.graylog.org/t/question-cant-get-the-notifications-altert-when-i-set-the-backlog-parameter/31655>\
**Category:** Graylog Central (peer support)\
**Tags:** alert\
**Created:** [February 29, 2024, 1:03am UTC](https://community.graylog.org/t/question-cant-get-the-notifications-altert-when-i-set-the-backlog-parameter/31655 "2024-02-29T01:03:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![samyhf](https://avatars.discourse-cdn.com/v4/letter/s/e47c2d/32.png) [@samyhf](https://community.graylog.org/u/samyhf)\
**Post date:** [February 29, 2024, 1:03am UTC](https://community.graylog.org/t/question-cant-get-the-notifications-altert-when-i-set-the-backlog-parameter/31655/1 "2024-02-29T01:03:53Z")

</div>

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.  
**Don’t forget to select tags to help index your topic!**

**1. Describe your incident:**  
I try to use the parameter “event” & “backlog” with http\_notifications.  
And “event” is return what I want.  
But when I used “backlog”, I cant receive the notifications.  
I want to know if I miss any configuration.  
can someone help me? Thx!

environment: graylog5.2.3  
Here is the template of my notification.

# [告警信息](http://graylog.org)

### **告警描述：{{.event\_definition\_description}}**

#### 告警触发时间：{{GetCSTtime .event.timestamp}}

#### 登录源IP：{{.event.fields.loginfrom}}

#### 登录账号：{{.event.fields.username}}

#### 告警设备：{{.event.fields.source}}

# [告警信息](http://graylog.org)

### **告警描述：{{.event\_definition\_description}}**

#### 告警触发时间：{{GetCSTtime .backlog.timestamp}}

#### 登录源IP：{{.backlog.fields.loginfrom}}

#### 登录账号：{{.backlog.fields.username}}

#### 告警设备：{{.backlog.fields.source}}

---

<div class="post-metadata">

**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\
**Post date:** [February 29, 2024, 5:00pm UTC](https://community.graylog.org/t/question-cant-get-the-notifications-altert-when-i-set-the-backlog-parameter/31655/2 "2024-02-29T17:00:44Z")

</div>

Can you clarify what this means?

> But when I used “backlog”, I cant receive the notifications.

Are you getting an error? Is there an error in the `server.log`?

Thanks.

---

<div class="post-metadata">

**Author:** ![coffee\_is\_life](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/coffee_is_life/32/12534_2.png) [@coffee\_is\_life](https://community.graylog.org/u/coffee_is_life)\
**Post date:** [March 1, 2024, 11:22am UTC](https://community.graylog.org/t/question-cant-get-the-notifications-altert-when-i-set-the-backlog-parameter/31655/3 "2024-03-01T11:22:05Z")

</div>

Hi,

in my cases where i need to extract the fields from backlog, the fields returned only values when i enclose it in breakets ( .backlog.[“fields”][“timestamp”] )

additional make sure, the triggered alert sends at least 1 backlog-message:  
 ![grafik](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/0/5/05a7c9cafb41fab33b566d535eb91db6034d40fb.png)

best regards,  
Coffee\_is\_life

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 15, 2024, 11:22am UTC](https://community.graylog.org/t/question-cant-get-the-notifications-altert-when-i-set-the-backlog-parameter/31655/4 "2024-03-15T11:22:39Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.