Send message to email from watcher


(Asim Husanovic) #1

Dear all,

I made one watcher for try to find specific sentence from my logs:

"query": {
"match": {
"Message": "Remote Desktop Services: User authentication succeeded"

Now, I want to parse rest of this log message and send to email like:
User successfully connected via RDP on from <remote_host>

I have a plan to make a one new watcher for unsuccessfully connection. It is necessary, or maybe I can write it inside this watcher?

How can I get username, hostname and remote_host in my BODY?

(Uri Boness) #2


Ideally the message processing would be done at ingestion time extracting the fields from the message and adding them as fields to the document.

Otherwise, you can consider using a script transform construct. You can use the script transform where the script will process the text, extract the metadata and return a new structured payload that can easily be used by the actions.

(system) #3