Windows System Event Log "message" details not accurate

Yeah its looking like the latter. When i get it built i’ll post it here for others. 

Ok, then it has to do with something LM is doing under the covers that they aren’t telling you about. Your options are to submit a feature request that they open it up or fix it or something, OR rebuild it yourself.

Good call on the email stage escalation. The message portion is fully written out there. 

The message token has always been a bit weird. Try adding your own email address to the escalation chain and check the email template to see that it includes the ##message## token. That will tell you if the problem is with the integration or with the message token itself.

Haha, sorry I should have posted the entire message and knew that might cause some confusion. And yes, the “Full Alert Details” works fine and is viewable within Teams. Yeah its a bit strange we don’t have full control over the data that's coming over with how good the testing ability is within the EventSource itself. I’m just trying to avoid the inevitable manager whining that the alert isn't face up with the details to begin with. 

Host: Hostname
Eventsource: Windows System Event Log
Windows Event ID: 42
Message: error - Hostname Windows System Event Log
Alert Rule: This alert matches the rule Systems-Error
Recipients: Alert now is going to stage 1 recipients: Name(Alert Channel)
Detected on: time:xx:xx

Wait, your payload has 5 lines in it, but what shows up in teams only has the one line? Sounds like LM is ignoring your desired payload. Or only putting your desired payload behind the “full alert details” button and creating their own “subject” line. 

Does the “full alert details” expand the card or is it a link to LM? I imagine teams uses the Adaptive Cards framework (they built it after all). Webex uses the same framework (why rebuild it when MS was nice enough to make it open?). I built our Webex teams integration from scratch and was able to specify the entirety of the card format. Seems like maybe LM is only letting you modify a small section of the card. 

If so, we should have them change it so you can pass in the JSON for the card itself as designed here instead of passing in a portion of the text you want pasted in.

Also, yeah i know i can click the button in the teams message “Full Alert Details” but that’s not ideal when you want your alerts face up and human readable at first glance.