How can I force new lines in alert emails?
We want to use Sumo Logic Alerts to send notifications and have the message easy to read.
I have message nicely formatted in the log
"@t":"2021-02-19T03:24:20.4443314Z",
-
"@mt":"Sheet Records 5, Successful 0, Failed 5
Failed Records:
TSA 222 Galileo PNR0, ticket 1234Ticket0: ItineraryId: 222 not found
TSA 224 Galileo PNR2, ticket 1234Ticket2: ItineraryId: 224 not found
TSA 223 Galileo PNR1, ticket 1234Ticket1: ItineraryId: 223 not found
TSA 226 Galileo PNR4, ticket 1234Ticket4: ItineraryId: 226 not found
TSA 225 Galileo PNR3, ticket 1234Ticket3: ItineraryId: 225 not found
", -
"@l":"Error",
but in email they all are shown as one string
- {"timestamp":1613705060444,"log":{"@t":"2021-02-19T03:24:20.4443314Z","@mt":"Sheet Records 5, Successful 0, Failed 5\nFailed Records:\nTSA 222 Galileo PNR0, ticket 1234Ticket0: ItineraryId: 222 not found\nTSA 224 Galileo PNR2, ticket 1234Ticket2: ItineraryId: 224 not found\nTSA 223 Galileo PNR1, ticket 1234Ticket1: ItineraryId: 223 not found\nTSA 226 Galileo PNR4, ticket 1234Ticket4: ItineraryId: 226 not found\nTSA 225 Galileo PNR3, ticket 1234Ticket3: ItineraryId: 225 not found\n","@l":"Error","SourceContext":"TsaNotesApi.ActualRefundsNotes.ActualRefundsNotesCreator","ActionId":"cf326e58-15c0-47c6-8bcc-02614320f97e","ActionName":"TsaNotesApi.Controllers.NotesController.LoadActualRefundsNotes
How can I create the email to be better formatted ?
-
I’ve resolved the issue by explicitly select field
| json field=_raw "log.@mt" as RESULTS
| fields RESULTS //only fields you specify for inclusion are kept in the search output.
and exclude system fields( https://help.sumologic.com/05Search/Search-Query-Language/Search-Operators/fields_operator#denylist)
| fields - _raw,_sourceHost,_sourceName,_sourceCategory
and RESULTS field is shown in email output in desired format.
Please sign in to leave a comment.
Comments
1 comment