Hi Stefan, alerts always contain a collection of messages (in the backlog variable) which you have to iterate over and never just a single message. Additionally, the templating can't be used in the email subject.
Please also refer to http://docs.graylog.org/en/2.0/pages/streams.html#email-alert-callback for information about the email alert callback and how to include arbitrary message fields (e. g. message.fields.ssh_login_username). Cheers, Jochen On Wednesday, 29 June 2016 08:25:51 UTC+2, Stefan Krüger wrote: > > Hello I've create a stream and an alert with email-call back, that works, > but not all variables are filled, here the callback: > > body: ########## > Alert Description: ${check_result.resultDescription} > Date: ${check_result.triggeredAt} > Stream ID: ${stream.id} > Stream title: ${stream.title} > Stream description: ${stream.description} ${if stream_url}Stream URL > : ${stream_url}${end} > > Triggered condition: ${check_result.triggeredCondition} > ########## > > > ${if backlog}Last messages accounting for this alert: > ${foreach backlog message}${message} > > > ${end}${else}<No backlog> > ${end} > > > sender: [email protected] > subject: root logged in on ${message.source} > > but ${message.source} is empty, but why? > > thanks for help! > > PS: is it possible to get special fields in this email? for example > message.ssh_login_username or other fields? > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/4d18b0d5-1acd-44e3-892c-464aabdb3b3c%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
