Using Grok patterns in Email notification

[jochen]

Event Information
=================

Event: Traffic blocked from leaving internal network
Detection IP: 10.100.52.10 
${if backlog} 
${foreach backlog message} 
Source IP: ${message.fields.fields.dst_ip}
Destination IP: ${message.fields.dst_ip}
${end}
${end}