In the below example I am able to send email after match condition. But How can I put original message inside of email alert.
For example : I want to send below original syslog text to email ...
24.04.2015 12:22:15 1 5 system,error,critical login failure for user testUser from 11.2.33.41 via ssh
We can extract username and login method from the syslog message, and pass it as parameters to an event with the following rule:
<match>system,error,critical login failure for user (.*) from .* via (.*)</match>
<event params="2">10000</event>
I format mail body with script, event calls mail action and mail action is calling script with %[scriptname] in message text.
if you want event param 2 use $event->parameters[2] in script
Create a string variable with all the text you want then just return it and it will use that for the mail text, for line break use \n
If you are scripting you have access to these to get the data you want also:
https://wiki.netxms.org/wiki/NXSL_Function_Reference (https://wiki.netxms.org/wiki/NXSL_Function_Reference)