# Report specific log entries via webhook

**URL:** <https://community.grafana.com/t/report-specific-log-entries-via-webhook/88852>\
**Category:** Grafana Loki\
**Tags:** loki, alerting\
**Created:** [June 2, 2023, 12:13pm UTC](https://community.grafana.com/t/report-specific-log-entries-via-webhook/88852 "2023-06-02T12:13:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![teunvink1](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/teunvink1/32/33295_2.png) [@teunvink1](https://community.grafana.com/u/teunvink1)\
**Post date:** [June 2, 2023, 12:13pm UTC](https://community.grafana.com/t/report-specific-log-entries-via-webhook/88852/1 "2023-06-02T12:13:15Z")

</div>

I’m trying to use Loki to detect specific log messages in my collection of syslog data, and report these messages via a webhook if they match a specific text.

I have a hard time figuring out how to write a alert rule and a notification for this. I can detect if there are any of these specific these messages:

`count_over_time({job="networking"} |= "abcdefghijklmnopqrst"[10s]) or vector(0)`

But if I then dump all data via a webhook, the value is the number of messages found of course, not the exact message lines. If I don’t use the ‘count\_over\_time’ function, I can’t determine if any matching lines are found.

Due to my inexperience with loki I’m probably missing something, but I wasn’t able to figure it out reading the docs. Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![jangaraj](https://sea2.discourse-cdn.com/grafana/user_avatar/community.grafana.com/jangaraj/32/39197_2.png) [@jangaraj](https://community.grafana.com/u/jangaraj)\
**Post date:** [June 2, 2023, 2:58pm UTC](https://community.grafana.com/t/report-specific-log-entries-via-webhook/88852/2 "2023-06-02T14:58:46Z")

</div>

I would create field (for example with whole log line for simplicity) with suitable parser and group by that field.

For example I have JSON logs and I want to be notified about watched action and user who did that:

```auto
sum(count_over_time(
{kind="mylogs"}[1m]
| json 
  user="user.name",
  action,
  timestamp,
| action="watched-action"
)) by (timestamp, user, action)

```

Then alert message can be (this example is for legacy alerting, new unified alerting has different syntax):

```auto
${timestamp}: ${user} ${action}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/grafana/original/2X/e/ef5308cc58c9e5a13187b5012eb99f406928462f.png) [@system](https://community.grafana.com/u/system)\
**Post date:** [June 1, 2024, 2:59pm UTC](https://community.grafana.com/t/report-specific-log-entries-via-webhook/88852/3 "2024-06-01T14:59:05Z")

</div>

Closed on June 1, 2024, 2:59pm UTC

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.