The field could not be added to log event alert action

[hoangpt]

I have a problem that needs everyone to help me. I am trying to create log from an alert.

Please tell me how to separate the relevant fields from the raw data and then map it to that alert log, e.g. src_ip, servity...

[dave_null · Accepted solution]

In the Event textfield, you can structure your generated event however you like. To insert values from the alert, use this format: (for example if you want to put src_ip field from the alert into the generated field)

$result.src_ip$

E.g. you can put this in the event text box:

Alert log - src_ip: $result.src_ip$ , severity: $result.severity$

[hoangpt]

Thank you for solving my problem 😄

[ITWhisperer]

The alert is triggered by a query. The first row of the results of the query are available to be used in the log message you create. Therefore, you need to include all the information you want to be in your log in the results of the query that triggers the alert.