# Empty log message in alert

**URL:** https://forum.opensearch.org/t/empty-log-message-in-alert/2293
**Category:** Alerting
**Created:** [February 26, 2020, 8:57am UTC](https://forum.opensearch.org/t/empty-log-message-in-alert/2293 "2020-02-26T08:57:40Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Serge](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@Serge](https://forum.opensearch.org/u/Serge)
#### Post date: [February 26, 2020, 8:57am UTC](https://forum.opensearch.org/t/empty-log-message-in-alert/2293/1 "2020-02-26T08:57:40Z")

</div>

In some cases notifications don’t contain log error body (timestamp, error text, etc.)

```
 {
"query": {
    "bool": {
        "filter": [
            {
                "bool": {
                    "filter": [
                        {
                            "multi_match": {
                                "query": "integration",
                                "fields": [],
                                "type": "phrase",
                                "operator": "OR",
                                "slop": 0,
                                "prefix_length": 0,
                                "max_expansions": 50,
                                "lenient": true,
                                "zero_terms_query": "NONE",
                                "auto_generate_synonyms_phrase_query": true,
                                "fuzzy_transpositions": true,
                                "boost": 1
                            }
                        },
                        {
                            "multi_match": {
                                "query": "ERROR",
                                "fields": [],
                                "type": "phrase",
                                "operator": "OR",
                                "slop": 0,
                                "prefix_length": 0,
                                "max_expansions": 50,
                                "lenient": true,
                                "zero_terms_query": "NONE",
                                "auto_generate_synonyms_phrase_query": true,
                                "fuzzy_transpositions": true,
                                "boost": 1
                            }
                        }
                    ],
                    "adjust_pure_negative": true,
                    "boost": 1
                }
            },
            {
                "range": {
                    "@timestamp": {
                        "from": "now-5m",
                        "to": null,
                        "include_lower": true,
                        "include_upper": true,
                        "boost": 1
                    }
                }
            }
        ],
        "adjust_pure_negative": true,
        "boost": 1
    }
},
"sort": [
    {
        "@timestamp": {
            "order": "desc"
        }
    }
]

```

}

and trigger

```
{
"title": "{{#ctx.results.0.hits.hits}}{{ctx.results.0.hits.hits.}}
<FONT size=3>LOG FILE: {{_source.log.file.path}}<br>
<FONT size=3>TIMESTAMP: {{_source.javalog.timestamp}}<br>
<FONT size=3>CLASS: {{_source.javalog.class}}<br><pre>
<FONT size=3>MESSAGE: {{_source.javalog.message}}</pre><br><br>{{/ctx.results.0.hits.hits}}",

"text": "Logged error(s) in environment"

```

}

Expected result:

> LOG FILE: /server.log  
> TIMESTAMP: 2020-02-25 21:35:12,504  
> CLASS: com.integrations.restapi.OrderService
> 
> MESSAGE: com.integrations.restapi.

Actual result:

> LOG FILE: /server.log  
> TIMESTAMP:  
> CLASS:
> 
> **MESSAGE:**

---

<div class="post-metadata">

### Author: ![dbbaughe](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dbbaughe](https://forum.opensearch.org/u/dbbaughe)
#### Post date: [March 7, 2020, 1:31am UTC](https://forum.opensearch.org/t/empty-log-message-in-alert/2293/2 "2020-03-07T01:31:37Z")

</div>

Hi @Serge,

My mustache skills are rusty, but do you need the `{{ctx.results.0.hits.hits.}} ` next to the # beginning the for loop in title? I believe you can just [refer to the current item](https://mustache.github.io/mustache.5.html). Just wondering if that’s screwing up the template parsing.

Otherwise can you check a time when this happened and look at the document(s) that triggered this and paste the document source (anonymized) so I can see the structure.

Thanks

---

<div class="post-metadata">

### Author: ![Serge](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@Serge](https://forum.opensearch.org/u/Serge)
#### Post date: [April 20, 2020, 8:42am UTC](https://forum.opensearch.org/t/empty-log-message-in-alert/2293/3 "2020-04-20T08:42:19Z")

</div>

I`ve found.  
Mistake in grok pattern. The “$” sign in message not parsed  
Please close this topic