Sending the desired logs via e-mail in Graylog

Graylog Central (peer support)
,
1

Hi everyone,

I want to send only the “new user created” and “a user deleted” logs among the logs that I have taken using graylog.

I can send e-mail to the address I specified at the moment, but this process does not work properly.
When I forward the logs to my own e-mail address, about 100 e-mails are received within 1 minute.
I also want to add information such as the IP address of my server and the name of the created user in this e-mail.

image

I am using 4.2.13-1 version of graylog.
My logs coming from windows server 2016 vm
I am using nxlog for taking the logs

I created the event and notification but I think they not work properly neither

I think I am missing something

Thank you in advance for your help

2

Hi @mustafa
I think in the first place you will need to get your events right. Make sure, you have only the right messages filtered in your event definition.
The second step you already took: attaching a notification to an event makes this to an alert.

If you want to include fields from the message alerting you you will need to use the “Field”-Tab in the event-definition. To make sure you have unique values in those fields you need to group by them in the “Filter and Aggregation”-Tab.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.