CrowdSec•3mo ago

Discord Notification Formatting Help

I found a custom discord.yaml template online that is almost perfect for me, however, it didn't have the target_fqdn in it. I've been trying to figure out how to add it with the same style as the rest of the notification. As you see in the image everything is printing correctly but I cant get each target_fqdn to be surrounded with backticks. Any help is appreicated. below is part of the fields section of my discord.yaml

27 Replies

CrowdSec•3mo ago

Important Information

Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command /resolve or press the green resolve button below.

Log Files

If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.

Guide Followed (CrowdSec Official)

If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.

Screenshots

Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.

WillpowerOP•3mo ago

        "fields": [

              {{range . -}}
              {{$alert := . -}}

              ,
              {
                "name": "Target FQDN",
                "value": "{{ (splitList "," ((GetMeta $alert "target_fqdn") | join "," | replace "\"" "`" | replace "[" "" | replace "]" "")) | join "\\n"}}",
                "inline": "false"
              }

              {{range .Meta -}}
              ,
              {
                "name": "{{.Key}}",
                "value": "{{ (splitList "," (.Value | replace "\"" "`" | replace "[" "" | replace "]" "")) | join "\\n"}}"
              }
              {{end -}}
              {{end -}}
        ]

        "fields": [

              {{range . -}}
              {{$alert := . -}}

              ,
              {
                "name": "Target FQDN",
                "value": "{{ (splitList "," ((GetMeta $alert "target_fqdn") | join "," | replace "\"" "`" | replace "[" "" | replace "]" "")) | join "\\n"}}",
                "inline": "false"
              }

              {{range .Meta -}}
              ,
              {
                "name": "{{.Key}}",
                "value": "{{ (splitList "," (.Value | replace "\"" "`" | replace "[" "" | replace "]" "")) | join "\\n"}}"
              }
              {{end -}}
              {{end -}}
        ]

iiamloz•3mo ago

So GetMeta returns plain strings, not an array of strings like .Meta does so your replace functions wont do anything as the values are not inside an array. Hence there no quotes to replace them with backticks

WillpowerOP•3mo ago

How would you recommend doing it then? Or is it not possible

_KaszpiR_•3mo ago

for a start try:

"value": "`{{ GetMeta $alert "target_fqdn" | join "\\n"}}`",

"value": "`{{ GetMeta $alert "target_fqdn" | join "\\n"}}`",

iiamloz•3mo ago

You can do

{{range (GetMeta $alert "target_fqdn" | uniq) -}}
`{{.}}`
{{ end -}}

{{range (GetMeta $alert "target_fqdn" | uniq) -}}
`{{.}}`
{{ end -}}

this will get the target_fqdn reduce the duplicates and then print each value in backticks

iiamloz•3mo ago

{{range (GetMeta $alert "target_fqdn" | uniq) -}}`{{.}}`\n{{ end -}}

{{range (GetMeta $alert "target_fqdn" | uniq) -}}`{{.}}`\n{{ end -}}

if you want a single one that has \n newlines within it.

iiamloz•3mo ago

this is the template tester we have at crowdsec https://playground.crowdsec.net/#/notifications

Crowdsec Playground

WillpowerOP•3mo ago

I wasnt able to get the tester working. What am i missing here?

WillpowerOP•3mo ago

i used cscli alerts inspect -o json 4997 to get the alert json

iiamloz•3mo ago

You have to put your own alert in the left hand side, note it needs to be []Alert you can wrap your alert in []

WillpowerOP•3mo ago

was that the right command?

iiamloz•3mo ago

yes to make it easier you can use cscli alerts inspect -o json 4997 | jq -c to get it to print a single line

WillpowerOP•3mo ago

jq isnt found. must not be in this docker image

iiamloz•3mo ago

ahh it isnt anymore

WillpowerOP•3mo ago

so i replace the { with [ on the first and last line?

iiamloz•3mo ago

no you wrap the whole object in [<alert>]

WillpowerOP•3mo ago

ah, so above it

iiamloz•3mo ago

WillpowerOP•3mo ago

im struggling getting your new line added to my entire yaml. im not getting any errors when testing the config but discord is denying the message HTTP server returned non 200 status code: 400" @module=http-plugin The alert sends but everything after country is cut off besides the map below it. the base of the yaml was from github so im not sure how clean it is https://pastebin.com/xgmThHvx If there's anything obvious please let me know

Pastebin

/etc/crowdsec/notifications/discord.yaml#type: httpname: discord...

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

WillpowerOP•3mo ago

yamllint says its a valid yaml ~~i got it working lol.~~ i was just missing the "" around the value on line 78 well i spoke too soon... sometimes it works and somethings it doesnt depending the scenario

WillpowerOP•3mo ago

i also noticed I cannot reinject my notifications

WillpowerOP•3mo ago

i guess the vaultwarden-bf notification doesnt track the rest of the data? I dont see any of the missing fields when inspecting the alert for vw while they are all there for the jellyfinbf alert json

iiamloz•3mo ago

Yeah vaultwarden won't have any fqdn since it's not on the proxy level. So I guess we can add an if statement to check the length. Cause I think discord rejects empty strings I didn't see the paste you already got it. So in short its working basically vaultwarden has no context and no fqdn so normal there nothing extra

WillpowerOP•3mo ago

Thanks again for the help. The only thing that’s not working is reinjecting the alerts to discord. Is that an issue on my end or is it an issue in crowdsec itself?

Gaming

Programming

Discord Notification Formatting Help

Did you find this page helpful?