Forum Discussion
PeteWhite
Jan 18, 2020Employee
That's a very interesting question - i haven't done it but the alert uses regex to detect the correct log so if you had 'Interface (.*?): link is down' then it may appear as $1
eg
alert ALERT_NAME "Interface (.*?): link is down" {
email toaddress="myemail@somewhere.com"
fromaddress="root"
body="Link $1 is down"
}
Give it a try and let me know
- boneyardMay 01, 2020MVP
had to try this but not the effect you hoped for, emails contains
Link $1 is down