# Script arguments for script notification **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** script\ **Created:** [July 18, 2023, 2:57pm UTC](https://community.graylog.org/t/script-arguments-for-script-notification/29573 "2023-07-18T14:57:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![samuel\_m](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@samuel\_m](https://community.graylog.org/u/samuel_m)\ **Post date:** [July 18, 2023, 2:57pm UTC](https://community.graylog.org/t/script-arguments-for-script-notification/29573/1 "2023-07-18T14:57:06Z")
Hi everyone, I’m not sure if this belongs in this topic. If not let me know and i’ll open it again where it belongs I’m trying to send info to a ticketing platform using script notification. I’m using python and i made it work as i wanted but now i’m facing a problem because i don’t understand how to send the message, the source IP and the input where it came I’ve been researching and it looks like i have to do something with event definitions. But i don’t know what to do Please any information will be very much appreciated If i need to provide more information about what i need please let me know. Thank you in advance for your time ---
**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\ **Post date:** [July 18, 2023, 7:10pm UTC](https://community.graylog.org/t/script-arguments-for-script-notification/29573/2 "2023-07-18T19:10:49Z")
I believe you can accomplish this using ‘Fields’ section when editing an event definition: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/30bd94d6cc5997c886851d0f5f7e033e847132be.png) It can be confusing so i’m including an example in the screenshot below. The summary is you can define additional ‘fields’ to be included as part of the alert message. The ‘template’ format is ${source.}. For `source_ip` it would be `${source.source_ip}` ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a146c1635b9eb9207e4620c5ac4e0adafc1773f7.png) Hope that helps. ---
**Author:** ![samuel\_m](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@samuel\_m](https://community.graylog.org/u/samuel_m)\ **Post date:** [July 19, 2023, 6:27am UTC](https://community.graylog.org/t/script-arguments-for-script-notification/29573/3 "2023-07-19T06:27:02Z")
Good morning Drew, I really appreciate your reply. I’ve try that and worked perfectly 😃 Is there any way to take that into script notifications? Can i call that ${source.x} from scripts or do i need to do something else? Again, thank you for your time and response Hope you’re having a good day ---
**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\ **Post date:** [July 19, 2023, 3:31pm UTC](https://community.graylog.org/t/script-arguments-for-script-notification/29573/4 "2023-07-19T15:31:33Z")
I did some testing and found that you can pass “fields” as a script `${event.fields.}` Here is an example: In the event definition, defining the field (as shown in my previous post, but adding here for clarity): ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/8e42c42ffa02fc305203e7a0ac2802fce19ece1d.png) In the script notification configuration page: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/931fdf2526d9ea715368e7a42dfce7097121afe8.png) Lastly, in case this is helpful (because it really helped me understand how to use the variables in the script arguments) here is a sample output that is sent to the script. I’ve formatted it as json: ```json { "id":"01H5QBSSVCE4WNR15NANXBCKDZ", "event_definition_type":"aggregation-v1", "event_definition_id":"64b7fdf80053d956a1f556df", "origin_context":"urn:graylog:message:es:gl_pfsense_0:c09aad80-2647-11ee-b30a-02423eedda53", "timestamp":"2023-07-19T15: 20: 11.000Z", "timestamp_processing":"2023-07-19T15: 20: 21.100Z", "timerange_start":null, "timerange_end":null, "streams":[], "source_streams":[ "6467ac711936e865130a6763" ], "message":"TEST script args with message fields", "source":"hplap", "key_tuple":[], "key":"", "priority":2, "alert":true, "fields":{ "event_action":"allowed" }, "group_by_fields":{}, "replay_info":{ "timerange_start":"2023-07-19T15: 19: 15.249Z", "timerange_end":"2023-07-19T15: 20: 15.249Z", "query":"application_name:filterlog", "streams":[ "6467ac711936e865130a6763" ] } } ``` each of these fields is accessible using the {$event.fieldName} notation. notice some data is nested such as the `fields` key. ---
**Author:** ![samuel\_m](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@samuel\_m](https://community.graylog.org/u/samuel_m)\ **Post date:** [July 24, 2023, 1:05pm UTC](https://community.graylog.org/t/script-arguments-for-script-notification/29573/5 "2023-07-24T13:05:04Z")
Good evening Drew, Sorry for the late reply i’ve been busy putting out a few fires in my office Once again thank you for your time and help. This seems to be working perfectly but now i have another problem. The field that contains the error log string seems to not be delimited by " so when i parse the arguments to my script it fails Is there any way around this? Can i add " to the field in some way? Thank you again for your help I hope you have a wonderful week ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 7, 2023, 1:05pm UTC](https://community.graylog.org/t/script-arguments-for-script-notification/29573/6 "2023-08-07T13:05:26Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.