# How to access document data (e.g. error message) in alert message using "Per document monitor" with "Extraction Query" (OpenSearch Alerting)

**URL:** <https://forum.opensearch.org/t/how-to-access-document-data-e-g-error-message-in-alert-message-using-per-document-monitor-with-extraction-query-opensearch-alerting/22392>\
**Category:** Alerting\
**Tags:** discuss\
**Created:** [November 12, 2024, 7:29pm UTC](https://forum.opensearch.org/t/how-to-access-document-data-e-g-error-message-in-alert-message-using-per-document-monitor-with-extraction-query-opensearch-alerting/22392 "2024-11-12T19:29:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![FaisalDevOps](https://avatars.discourse-cdn.com/v4/letter/f/cab0a1/32.png) [@FaisalDevOps](https://forum.opensearch.org/u/FaisalDevOps)\
**Post date:** [November 12, 2024, 7:29pm UTC](https://forum.opensearch.org/t/how-to-access-document-data-e-g-error-message-in-alert-message-using-per-document-monitor-with-extraction-query-opensearch-alerting/22392/1 "2024-11-12T19:29:08Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

Hi I have configure OpenSearch Alert and giving query which will extract  
“logEvents.message”: containing error message .The query running fine and giving logs which containing error logs. i want that Alert trigger that complete error log in the Email body i have used many syntax but it didnt work.

e.g : {  
“subject”: “Alert: Error Detected in Logs”,  
“body”: “Here are the log details:\n\nTotal Hits: {{ctx.results[0].hits.total.value}}\n\n{{#ctx.results[0].hits.hits}}\n- Message: {{\_source.logEvents.message}}\n- Timestamp: {{\_source.@timestamp}}\n{{/ctx.results[0].hits.hits}}”  
}

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![ssablan](https://avatars.discourse-cdn.com/v4/letter/s/ebca7d/32.png) [@ssablan](https://forum.opensearch.org/u/ssablan)\
**Post date:** [November 20, 2024, 5:34pm UTC](https://forum.opensearch.org/t/how-to-access-document-data-e-g-error-message-in-alert-message-using-per-document-monitor-with-extraction-query-opensearch-alerting/22392/2 "2024-11-20T17:34:00Z")

</div>

The document is located in ctx - alerts - sample documents array:

{{ctx.alerts.0.sample\_documents.0.\_source}}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [January 19, 2025, 5:35pm UTC](https://forum.opensearch.org/t/how-to-access-document-data-e-g-error-message-in-alert-message-using-per-document-monitor-with-extraction-query-opensearch-alerting/22392/3 "2025-01-19T17:35:00Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.