Hi Dennis, the documentation already says:
> message (only available via iteration over the backlog object) Additionally the default email template also can serve as an example. Any suggestions for how to improve the documentation on this topic are welcome! Feel free to post your suggestions at https://github.com/Graylog2/documentation/issues. Cheers, Jochen On Wednesday, 1 June 2016 16:19:54 UTC+2, Dennis Seaton wrote: > > Thanks Jochen, > > After a lot of trial and error I've learned you have to involve "the > backlog object" or you can't access your fields. My callback eventually > looked something like this: > > ACCOUNT LOCKED OUT > ${if backlog} > ${foreach backlog message} > Username: ${message.fields.ad_username} > Server: ${message.fields.source} > Client: ${message.fields.machine_name} > Time: ${message.fields.EventReceivedTime} > ${end}${else}<No backlog> ${end} > > > On Tuesday, 31 May 2016 12:19:56 UTC-4, Jochen Schalanda wrote: >> >> Hi Dennis, >> >> you can only reference fields listed in >> http://docs.graylog.org/en/1.3/pages/streams.html#alert-callbacks-types-explained >> >> in your email template (scroll down a little bit). >> >> In your case, you would access the ad_username field of the message with >> ${message.fields.ad_username}. >> >> Cheers, >> Jochen >> >> On Tuesday, 31 May 2016 17:58:33 UTC+2, Dennis Seaton wrote: >>> >>> I have an extractor that pulls the username whenever someone is locked >>> out of my Windows domain. It puts the username into a field called >>> *ad_username*. I now want to use that custom field that I made inside >>> an email callback so I can send extremely simplified email alerts like this: >>> >>> *A user was locked out of the domain at ${check_result.triggeredAt} * >>> *The user was: ${ad_username}* >>> >>> I've seen the Callback documentation here >>> <http://docs.graylog.org/en/1.3/pages/streams.html#alert-callbacks-types-explained> >>> but >>> it is lacking detail on how to do this. >>> >>> Can anyone tell me if it's possible? How can I use my own fields in the >>> callbacks? >>> >>> >>> >>> Thanks in advance >>> >>> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/950f65dc-d771-470d-a940-32d45ce4be75%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
