Is it possible to remove the backglog message from the email alert being sent? Or as an alternative put the information I want that staff to see above the backlog? What I have works, just trying to clean it up a bit.
Currently my format is:
${if backlog}
${foreach backlog message}${message}
${message.fields.winlogbeat_task}
${message.fields.winlogbeat_event_data_TargetUserName}
${message.fields.winlogbeat_event_data_IpAddress}
${message.fields.winlogbeat_event_data_IpAddress_country_code}
${message.fields.winlogbeat_event_data_IpAddress_city_name}
${message.fields.winlogbeat_event_data_WorkstationName}
${end}${else}<No backlog>
${end}