On This Page

Home / Edge/ Administering· Notifications/Email Notifications

Email Notifications

If you’re a Cribl Edge admin, email notifications make it easy to receive alerts about any operational issues that require your attention, such as a particular Source or Destination condition or a pending license expiration.

An email Notification requires two things — a configured Notification and an email Notification target. Cribl.Cloud Organizations using certain plan/license tiers also have access to a preconfigured email Notification target.

Email Notifications do not have an unsubscribe option. Recipients who do not want to receive particular email Notifications should contact their Cribl Edge admins.

Email Notifications are sent on a no-reply basis.

Configure Email Notifications
​

When you create a Notification for an email target, specify the recipients of the message, the subject line, and the contents of the message.

Email Notification with target selected
Email Notification with target selected

Target: The ID of the email target to which you want to send the Notification.

Select Add target to add an existing target.

Select Create target to create a new target. For information on configuring email Notification targets, see Email Notification Targets.

If the Notification already has a designated target, you can change the selection by selecting the drop-down.

When an email Notification target is selected, the following additional fields appear:

To: The email address of the recipient.

Add cc: When enabled, reveals a field where you can enter the addresses of additional recipients.

Add bcc: When enabled, reveals a field where you can enter the addresses of additional recipients that do not appear in the Notification email.

Cribl Edge does not limit the total number of recipients for a Notification, but your email service might set a limit.

Subject: The subject line of the email Notification. You can use variables in the subject line.

Message: The content of an email Notification. You can use variables in the body of the email message.

Email Notification Variables
​

Email variables are placeholders in the email template that get replaced with actual values when the email is sent. These variables can be:

  • General-use variables, like condition, worker_group, or timestamp
  • Special-purpose variables

You can use a variety of general-use and special-purpose variables in the subject or message body of an email Notification. Insert a variable name between two braces preceded by a $. For example: ${cribl_notification}.

General-Use Email Variables
​

VariableDescription
workspaceWorkspace name (Cribl.Cloud only).
organizationOrganization ID (Cribl.Cloud only).
timestampTimestamp when the email is sent. For example: 2019-08-04 18:22:24 UTC.
cribl_notificationUser-defined notification ID.

Special-Purpose Email Variables
​

VariableUsageNotification typeExample
_rawThe _raw field of the Event triggering the Notification.
  • License expiration
  • Cribl Search
Your Cribl license expires in 3 days on 2019-08-04 18:22:24 UTC. Please update your license to continue processing data after 2019-08-04 18:22:24 UTC.
__worker_groupName of the Worker Group triggering the Notification.
  • Destination Backpressure
  • High data volume
  • Low data volume
  • No data
  • Persistent Queue Usage
  • Unhealthy Destination
default
timewindowMetric evaluation period used for Notification.
  • Destination Backpressure
  • High data volume
  • Low data volume
  • No data
  • Persistent Queue Usage
  • Unhealthy Destination
60s
statusStatus of the Notification
Status of backpressure engagement.
  • Destination Backpressure
  • High data volume
  • Low data volume
  • No data
  • Persistent Queue Usage
  • Unhealthy Destination
OK, ALARM
DISENGAGED, BLOCKING or DROPPING
inputType and name of a Source or Collector.
  • High data volume
  • Low data volume
  • No data
syslog:in_syslog_1
outputType and name of a Destination.
  • Destination Backpressure
  • Persistent Queue Usage
  • Unhealthy Destination
webhook:out_webhook_1
bytesQuantity of data triggering the specified Notification.
  • High data volume
  • Low data volume
  • No data
0
dataVolumeData volume which triggered the Notification. Accepts numerals with units like KB, MB, and so on.
  • High data volume
  • Low data volume
1G
healthHealth metric of the specified Source or Destination.
  • Unhealthy Destination
0
queue_usagePercentage of capacity set in the Usage threshold field.
  • Persistent Queue Usage
90
usageThe actual usage, in percent.
  • Persistent Queue Usage
50
usageThresholdThe usage threshold, in percent.
  • Persistent Queue Usage
50

Troubleshoot Email Notifications
​

The section details the troubleshooting steps you can take if an email Notification fails to reach its intended recipient.

Test the Email Notification Target
​

An email Notification can fail if the target is misconfigured. You can test your email Notification target by following this procedure:

  1. Open the target (in Notifications > Targets).
  2. Select Test Target.
  3. Add one or more email addresses to the Test Target modal and select Send Test Email.
  4. Check the designated inbox to verify receipt of the test message. If it does not arrive in the designated inbox, review the target configuration.

Check Notification Service Logs
​

A failed email Notification leaves a log entry. You can examine logs by following this procedure:

  1. Select Monitoring > Logs.
  2. In the drop-down on the left, select Leader > Notifications Service.
  3. Examine any logs that have errors.

Check Notifications
​

Cribl Edge stores Notifications. You can check them by following this procedure:

  1. Select Monitoring > Notifications.
  2. In the search field, search for cribl_notification fields that correspond to the Notification ID of the failed Notification.