Graylog2 / Graylog2/graylog2-server

Access to Event -> Filter -> SearchQuery value in the Notification Message field

Open
#10,191 0 comments 0 reactions 0 assignees View on GitHub
alerting feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## What?

It would be nice to have access to an Event - FIlter - SearchQuery value in the Notification Message field
There are already exist some Event definition values like below

--- [Event Definition] ---------------------------

**ID:** ${event_definition_id}
**Type:** ${event_definition_type}
**Title:** ${event_definition_title}
**Description:** ${event_definition_description}

--- [Event] --------------------------------------

**Event:** ${event}
--- [Event Detail] -------------------------------

**Timestamp:** ${event.timestamp}
**Message:** ${event.message}
**Source:** ${event.source}
**Key:** ${event.key}
**Priority:** ${event.priority}
**Alert:** ${event.alert}
**Timestamp Processing:** ${event.timestamp}
**TimeRange Start:** ${event.timerange_start}
**TimeRange End:** ${event.timerange_end}

But if I'm right, nothing about Filter Query Search value

## Why?

It will help us to build a search query link in the Notification message template to find logs
related with fired Event
In the end, a link might look like this
https://your_graylog_host/streams/${stream_id}/search?q=${event.filter_search_value}&rangetype=absolute&streams=${stream_id}&from=${message.timestamp}&to=${message.timestamp}

## Your Environment

* Graylog Version: 3.x | 4.x
* Elasticsearch Version:
* MongoDB Version:
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.