Thanks Jochen,
After a lot of trial and error I've learned you have to involve "the
backlog object" or you can't access your fields. My callback eventually
looked something like this:
ACCOUNT LOCKED OUT
${if backlog}
${foreach backlog message}
Username: ${message.fields.ad_username}
Server: ${message.fields.source}
Client: ${message.fields.machine_name}
Time: ${message.fields.EventReceivedTime}
${end}${else}<No backlog> ${end}
On Tuesday, 31 May 2016 12:19:56 UTC-4, Jochen Schalanda wrote:
>
> Hi Dennis,
>
> you can only reference fields listed in
> http://docs.graylog.org/en/1.3/pages/streams.html#alert-callbacks-types-explained
>
> in your email template (scroll down a little bit).
>
> In your case, you would access the ad_username field of the message with
> ${message.fields.ad_username}.
>
> Cheers,
> Jochen
>
> On Tuesday, 31 May 2016 17:58:33 UTC+2, Dennis Seaton wrote:
>>
>> I have an extractor that pulls the username whenever someone is locked
>> out of my Windows domain. It puts the username into a field called
>> *ad_username*. I now want to use that custom field that I made inside an
>> email callback so I can send extremely simplified email alerts like this:
>>
>> *A user was locked out of the domain at ${check_result.triggeredAt} *
>> *The user was: ${ad_username}*
>>
>> I've seen the Callback documentation here
>> <http://docs.graylog.org/en/1.3/pages/streams.html#alert-callbacks-types-explained>
>> but
>> it is lacking detail on how to do this.
>>
>> Can anyone tell me if it's possible? How can I use my own fields in the
>> callbacks?
>>
>>
>>
>> Thanks in advance
>>
>>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/e1fef9de-cf9c-4518-b48d-6b2e0bbb8b6d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
