Feature Request: Show messages that caused alert in Slack

[stepkirk]

Thanks for building this plugin. Very useful.

I have configured the stream alert in Graylog as follows: Alert is triggered when there are more than 3 messages in the last minute. Grace period: 30 minutes. Including last 3 messages in alert notification.

When the alert triggers, I get a message in Slack but it does not include any of the messages that triggered the alert. That means we need to click on the embedded link to see the search results. If we could view the triggering messages in the Slack alert itself, that might keep us from having to connect to our VPN to see what caused the trigger.

Hopefully that makes sense.

Thanks, Steve.

[joshbeard]

This should also support truncating, ideally via a configurable amount. E.g. my Tomcat messages have the potential to span many lines, and I wouldn't want all those in a Slack message.

[lennartkoopmann]

Thank you! Scheduled for v1.3.

[stepkirk]

Thanks for the updated Slack plugin V2.01 this week Lennart.

Installed it this morning and redid the callback as instructed in the README.

When I trigger an alert, I get the alert in Slack but I don't see the message that triggered the alert. Should that be in the Slack message? Do I need to do anything to enable that?

Thanks again for your work on this.

Steve.

[infernix]

Yes, please add the ability to add backlogged messages in the alert stream attachment

[stepkirk]

Never mind. I missed this configuration step when I originally set this up:

The same applies for message outputs which you can configure in Stream - > Manage Outputs.

Once you setup an Output for sending messages to Slack, the alert will include the message(s) that caused the alert.

Woo hoo!