
Hi Thomas,
You can use the "rename" command to produce output on a Jinja template.You need to edit the search query in your alert rule to the following:
[..] as s1 followed by [..] as s2 on s1.user=s2.user | process geopip(s2.source_address) | rename log_ts as tidspunkt_ts, s2.user as bruger, s2.machine as computernavn, s2.os_version as OS, s2.source_address as IP, country_name as land, city_name as 'by'|chart count() by tidspunkt_ts, bruger, computernavn, OS, IP, land, 'by'
Once you add the required fields in chart form, you will be able to get the desired values for each placeholder in your email notification.
Let us know if you have any further queries.
2 comments