# How do i include message fields in the Alert Action Message

**URL:** <https://forum.opensearch.org/t/how-do-i-include-message-fields-in-the-alert-action-message/8167>\
**Category:** Alerting\
**Tags:** configure\
**Created:** [January 2, 2022, 2:15pm UTC](https://forum.opensearch.org/t/how-do-i-include-message-fields-in-the-alert-action-message/8167 "2022-01-02T14:15:18Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![AndreyB](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@AndreyB](https://forum.opensearch.org/u/AndreyB)\
**Post date:** [January 6, 2022, 7:06am UTC](https://forum.opensearch.org/t/how-do-i-include-message-fields-in-the-alert-action-message/8167/4 "2022-01-06T07:06:37Z")

</div>

So here is the solution:

1. Discover the data you want to add alert to it in index.
2. Save the query.
3. Create a monitor based on query and change the default format to epoch\_millis.  
 ![Screen Shot 2022-01-06 at 8.59.21](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/e/e757ee06c42b37d3a1101d4f66383b944001bad0.jpeg)

```auto
{
    "size": 500,
    "query": {
        "bool": {
            "filter": [
                {
                    "match_all": {
                        "boost": 1
                    }
                },
                {
                    "exists": {
                        "field": "m.alert.severity",
                        "boost": 1
                    }
                },
                {
                    "exists": {
                        "field": "m.alert.name",
                        "boost": 1
                    }
                },
                {
                    "range": {
                        "@timestamp": {
                            "from": "{{period_end}}||-2m",
                            "to": "{{period_end}}",
                            "include_lower": true,
                            "include_upper": true,
                            "format": "epoch_millis",
                            "boost": 1
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    },
    "version": true,
    "_source": {
        "includes": [],
        "excludes": []
    },
    "stored_fields": "*",
    "docvalue_fields": [
        {
            "field": "@timestamp",
            "format": "date_time"
        },
        {
            "field": "created",
            "format": "date_time"
        },
        {
            "field": "m.params.cartProducts.createdTime",
            "format": "date_time"
        },
        {
            "field": "m.time",
            "format": "date_time"
        }
    ],
    "script_fields": {},
    "sort": [
        {
            "@timestamp": {
                "order": "desc",
                "unmapped_type": "boolean"
            }
        }
    ],
    "aggregations": {
        "2": {
            "date_histogram": {
                "field": "@timestamp",
                "time_zone": "Asia/Jerusalem",
                "fixed_interval": "1s",
                "offset": 0,
                "order": {
                    "_key": "asc"
                },
                "keyed": false,
                "min_doc_count": 1
            }
        }
    },
    "highlight": {
        "pre_tags": [
            "@opensearch-dashboards-highlighted-field@"
        ],
        "post_tags": [
            "@/opensearch-dashboards-highlighted-field@"
        ],
        "fragment_size": 2147483647,
        "fields": {
            "*": {}
        }
    }
}

```

---

_[View the full topic](https://forum.opensearch.org/t/how-do-i-include-message-fields-in-the-alert-action-message/8167)._