Some of the alert fields are empty

Graylog Central (peer support)
1

Hey guys… I was hoping to find some help on alerts.

I got a graylog server version 4.0.8 installed and accepting inputs good.
I’ve configured an alert tempalte as below

##########
Description: ${check_result.resultDescription}
Date: ${check_result.triggeredAt}
Stream: ${stream.title}
Stream description: ${stream.description}
Condition: ${alertCondition.title}
${if stream_url}Stream URL: ${stream_url}${end}

Trigger: ${check_result.triggeredCondition}
##########

${if backlog}Last messages accounting for this alert:
${foreach backlog message}${message}

${end}${else}<No backlog>
${end}

The alerts come out with all the header fields empty. The only thing that shows correctly in an email is the message and any backlogs (stuffs after the #####).

##########
Description:
Date:
Stream:
Stream description:
Condition:

Trigger:
##########

The subject is formatted as
Graylog alert for stream: ${stream.title}: ${check_result.resultDescription}

Which also came out blank as
Graylog alert for stream: :

Where did I go wrong guys?

2

I don’t know where do you get fields names like check_result and so on? Are there a custom event fields?

Or normal fields which you created using extractors or pipeline rules? Is so, you need to use this syntax (replace src_ip with your field name), you need to use foreach loop to get field value:
${foreach backlog message}${message.fields.src_ip}${end}

Default email template uses pre-defined fields:

--- [Event Definition] ---------------------------
Title:       ${event_definition_title}
Description: ${event_definition_description}
Type:        ${event_definition_type}
--- [Event] --------------------------------------
Timestamp:            ${event.timestamp}
Message:              ${event.message}
Source:               ${event.source}
Key:                  ${event.key}
Priority:             ${event.priority}
Alert:                ${event.alert}
Timestamp Processing: ${event.timestamp}
Timerange Start:      ${event.timerange_start}
Timerange End:        ${event.timerange_end}
Fields:
${foreach event.fields field}  ${field.key}: ${field.value}
${end}
${if backlog}
--- [Backlog] ------------------------------------
Last messages accounting for this alert:
${foreach backlog message}
${message}
${end}
${end}

Their description you can find in docs:
https://docs.graylog.org/en/4.0/pages/alerts.html#data-available-to-notifications

3

Thanks for your reply!
Apparently I made a very rookie mistake. I copied the alert configuration from an older installation from a different site which had a different version and different syntax.

I’ve used the syntax you showed above and it worked out just fine. You’re awesome!