The simplest solution is to select the command type in the alert method when creating the rule and enter the command:
["/usr/bin/curl" , "-k" , "https://IP_smsEAGLE/http_api/send_sms?access_token=xxxxxxxxxxxxxxxxxxxxx&to=+xxxxxxxxxxx&message=Test-{match[agent][name]},{match[winlog] [event_id]}" , "-sS" ]
Required fields are: Gateway IP, token, phone number to which the message is to be sent and content.
Syntax:
{match[agent][name]},{match[winlog][event_id]}- the content refers to fields from the given index to which the notification applies.
The following entry should be added to the Rule Description:
new_style_string_format: true
