# Email alerting in Kibana not getting more data

**URL:** <https://forum.opensearch.org/t/email-alerting-in-kibana-not-getting-more-data/8109>\
**Category:** Alerting\
**Created:** [December 22, 2021, 10:50am UTC](https://forum.opensearch.org/t/email-alerting-in-kibana-not-getting-more-data/8109 "2021-12-22T10:50:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wazuhsai](https://avatars.discourse-cdn.com/v4/letter/w/dec6dc/32.png) [@wazuhsai](https://forum.opensearch.org/u/wazuhsai)\
**Post date:** [December 22, 2021, 10:50am UTC](https://forum.opensearch.org/t/email-alerting-in-kibana-not-getting-more-data/8109/1 "2021-12-22T10:50:30Z")

</div>

Hi Team,

I have configure the alerting section to an gmail in opendistro kibana 7.10.2 version,

Here i was getting limited information to the mail

Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.

- Trigger: {{ctx.trigger.name}}
- Severity: {{ctx.trigger.severity}}
- Period start: {{ctx.periodStart}}
- Period end: {{ctx.periodEnd}}  
-Username: {{ctx.results.0.hits.hits.0.\_source.user}}

So Here my requirement is like need to get the real-time live data from the Index pattern values such as index pattern name ,document ID of the event in index, source IP , Dest IP etc,

I was using the opendistro elasticsearch 7.10.2 with the wazuh 4.1.5 version.

Please provide some relevant information about this.

Thanks & Regards,

wazuhsai

---

<div class="post-metadata">

**Author:** ![mudboyzh](https://avatars.discourse-cdn.com/v4/letter/m/c68b51/32.png) [@mudboyzh](https://forum.opensearch.org/u/mudboyzh)\
**Post date:** [December 27, 2021, 1:39am UTC](https://forum.opensearch.org/t/email-alerting-in-kibana-not-getting-more-data/8109/2 "2021-12-27T01:39:44Z")

</div>

Hi @wazuhsai ,  
[Here](https://opendistro.github.io/for-elasticsearch-docs/docs/alerting/monitors/#available-variables) is available variables can use with ` ctx`.  
I assume source IP,Dest IP is in your own data.  
You might need to use aggregation in the query of monitor.  
Using [terms aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) to group by source ip or dest ip.  
[bucket\_selector](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-pipeline-bucket-selector-aggregation.html) can help you filter some bucket in your aggregation.  
Using like `ctx.results[0].aggregations.` with [Mustache](https://mustache.github.io/mustache.5.html) to build message.