Use extracted field as email alert recipient

Graylog Central (peer support)
1

Hi!

We love graylog, thank you for making it available!!

Have setup an extractor to extract “ad_username” from authentication failures. Now we want to setup an alert for more than X authentication failures in a row, to alert the end user. So, as an alert recipeint, we are trying to use the extracted username, like: ad_username@company.com

However, the “ad_username” is kept, rather then being replaced by the actual username, so the email is sent to ad_username@company.com which of course does not work. :slight_smile:

We tried: ${ad_username}@company.com, $${$ad_username}@company.com, {$ad_username}@company.com, etc, all with similar result.

Is what we are trying to do possible? FYI: graylog 2.4 (yes, we need to upgrade)

2

he @kkplein

such a request is not possible. It would be a feature request over at github. But that will be never get a backport to that version you are using.

3

Hi Jan,

Aha, not possible now, good to know I’m not missing something. I will submit a feature request, and of course I understand that it would not be ported to our old version. :slight_smile: We have to upgrade anyway, and that is fine. Just haven’t done it yet.

Thanks for the reply!

4
2 Likes
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.