# \[REQ\] Help to customize the body of the email Alarm Notification

**URL:** <https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151>\
**Category:** Graylog Central (peer support)\
**Created:** [March 24, 2022, 9:37am UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151 "2022-03-24T09:37:22Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![alessio.dapelo](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@alessio.dapelo](https://community.graylog.org/u/alessio.dapelo)\
**Post date:** [March 24, 2022, 9:37am UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/1 "2022-03-24T09:37:22Z")

</div>

Good morning,  
I need some help to customize the body of the email that graylog sends me in case a certain event occurs.  
I’m testing with Suricata 6 which sends match logs of its signatures to Graylog.  
I proceeded to create some extractors using the Regular expression function, now part of the message has been split.  
At the moment the email body is configured as default.

I use Graylog v4.2.7+879e651

```auto
--- [Event Definition] ---------------------------
Title: ${event_definition_title}
Description: ${event_definition_description}
Type: ${event_definition_type}
--- [Event] --------------------------------------
Timestamp: ${event.timestamp}
Message: ${event.message}
Source: ${event.source}
Key: ${event.key}
Priority: ${event.priority}
Alert: ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start: ${event.timerange_start}
Timerange End: ${event.timerange_end}
Fields:
${foreach event.fields field} ${field.key}: ${field.value}
${end}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
${end}

```

Below I show you an example of a log that I receive from Suricata 6 cleaned of sensitive data.

```auto
2022-03-24 08:03:01.211 +01:00	XXXXXXXXXXX
2022-03-24T08:03:00.671491+0100 Source IP: XXX.XXX.XXX.XXX:XXXX Destination IP: XXX.XXX.XXX.XXX:XXXX protocol: TCP signature: ET POLICY XXXXXXXXXXXXXXXXXXXXXXXXXXXXt
 XXXXXXXXXXXXXXXXXXXXXXXXXXX

Timestamp
    2022-03-24 08:03:01.211
Received by
    appliance-syslog-udp on 

     xxxxxxxxx / xxxxxxxx
Stored in index
    graylog_358
Routed into streams

        All messages
        Alert Level 2

application_name
    XXXXXXXX
destip
    XXX.XXX.XXX.XXX
facility
    user-level
facility_num
    1
isSynced
    0
level
    2
message
    2022-03-24T08:03:00.671491+0100 Source IP: XXX.XXX.XXX.XXX:XXXX Destination IP: XXX.XXX.XXX.XXX:XXXX protocol: TCP signature: ET POLICY ET POLICY XXXXXXXXXXXXXXXXXXXXXXXXXXXX
signature
    ET POLICY XXXXXXXXXXXXXXXXXXXXXXXXXXXX
source
    XXXXXXXXXXX
sourceip
    XXX.XXX.XXX.XXX
timestamp
    2022-03-24 08:03:01.211 +01:00
tzKnown
    1

```

At the moment with the default configuration I get an email that includes all the message field in a single body,  
I would like you to get a more readable email as in the example below.

```auto
--- [Event Definition] ---------------------------
Title: Alert Event Level 1
Description: Alert Event Level 1
Type: aggregation-v1
--- [Event] --------------------------------------
Timestamp: 2022-03-23T09:14:06.128Z
Message: Alert Event Level 1
Source: XXXXXX
Key:
Priority: 3
Alert: true
Timestamp Processing: 2022-03-23T09:14:06.128Z Timerange Start:
Timerange End:
Fields:

Source: source
Source Ip:	sourceip
Destination Ip:	destip
Signature:	signature

--- [Backlog] ------------------------------------
Last messages accounting for this alert:

{index=graylog_385, message=XXXXXXXXXXXXXXXXXXX}

```

Obviously the syntax is incorrect, what I would like to add to the default is to have the fields separated as indicated below.

```auto
Source: source
Source Ip:	sourceip
Destination Ip:	destip
Signature:	signature

```

Could anyone help me change the syntax?  
Thanks in advance.

Alessio

---

<div class="post-metadata">

**Author:** ![valhaim](https://avatars.discourse-cdn.com/v4/letter/v/67e7ee/32.png) [@valhaim](https://community.graylog.org/u/valhaim)\
**Post date:** [March 24, 2022, 3:26pm UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/2 "2022-03-24T15:26:57Z")

</div>

Hello,

you can access the fields with message.

For example:

```auto
Source: ${message.source}

```

---

<div class="post-metadata">

**Author:** ![alessio.dapelo](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@alessio.dapelo](https://community.graylog.org/u/alessio.dapelo)\
**Post date:** [April 4, 2022, 7:08am UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/3 "2022-04-04T07:08:10Z")

</div>

Thanks for the answer.  
I already did, but I probably added that string in the wrong place in the template.

---

<div class="post-metadata">

**Author:** ![alessio.dapelo](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@alessio.dapelo](https://community.graylog.org/u/alessio.dapelo)\
**Post date:** [April 4, 2022, 7:59am UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/4 "2022-04-04T07:59:00Z")

</div>

I modified the template as follows, but only the Signature field is filled with the extracted data, the other three fields in the received email remain empty.  
See `[Backlog]` code.

```auto
--- [Event Definition] ---------------------------
Title: ${event_definition_title}
Description: ${event_definition_description}
Type: ${event_definition_type}
--- [Event] --------------------------------------
Timestamp: ${event.timestamp}
Message: ${event.message}
Source: ${event.source}
Key: ${event.key}
Priority: ${event.priority}
Alert: ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start: ${event.timerange_start}
Timerange End: ${event.timerange_end}
Fields:
${foreach event.fields field} ${field.key}: ${field.value}
${end}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
Source: ${message.source}
Source Ip:	${message.sourceip}
Destination Ip:	${message.destip}
Signature:	${message.signature}
${end}
${end}

```

---

<div class="post-metadata">

**Author:** ![valhaim](https://avatars.discourse-cdn.com/v4/letter/v/67e7ee/32.png) [@valhaim](https://community.graylog.org/u/valhaim)\
**Post date:** [April 4, 2022, 8:07am UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/5 "2022-04-04T08:07:42Z")

</div>

Hi,

the formatting seems right. Please check the received message from your mail with the message at graylog for the missing fields. Are they there? Are they empty?

---

<div class="post-metadata">

**Author:** ![alessio.dapelo](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@alessio.dapelo](https://community.graylog.org/u/alessio.dapelo)\
**Post date:** [April 4, 2022, 8:28am UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/6 "2022-04-04T08:28:51Z")

</div>

Checking the email received:

Source: $ {message.source} - The field contains the data  
Source ip: $ {message.sourceip} - The field is empty  
Destination IP: $ {message.destip} - The field is empy  
Signature: $ {message.signature} - The field is empty

The values in the log on graylog appear regularly, they are present.

I tried to request only the field below:  
Source Ip: $ {message.sourceip}  
Blank result.  
I imagine at this point that the data is not found in message.sourceip but that he has to search for it elsewhere since souceip is a data obtained from the main message through the use of an extractor with regular expression option

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 4, 2022, 12:04pm UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/7 "2022-04-04T12:04:07Z")

</div>

Try adding in `.fields` and perhaps it’s `${message.message}`

```auto
${foreach backlog message}
   ${message.message}
   Source: ${message.source}
   Source Ip: ${message.fields.sourceip}
   Destination Ip: ${message.fields.destip}
   Signature: ${message.fields.signature}
${end}

```

---

<div class="post-metadata">

**Author:** ![alessio.dapelo](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@alessio.dapelo](https://community.graylog.org/u/alessio.dapelo)\
**Post date:** [April 4, 2022, 12:22pm UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/8 "2022-04-04T12:22:38Z")

</div>

Tnx, now work perfectly !!!

---

<div class="post-metadata">

**Author:** ![alessio.dapelo](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@alessio.dapelo](https://community.graylog.org/u/alessio.dapelo)\
**Post date:** [April 4, 2022, 12:30pm UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/9 "2022-04-04T12:30:44Z")

</div>

Problem solved  
Now I understand the correct syntax  
Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 18, 2022, 12:31pm UTC](https://community.graylog.org/t/req-help-to-customize-the-body-of-the-email-alarm-notification/23151/10 "2022-04-18T12:31:17Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.