How to include message fields in the Alert Action Message for Per query monitor

[Juergen]

Hi,

what you need is explanied here:

OpenSearch: including document fields in alert messages

and here:

How do i include message fields in the Alert Action Message

So here is the solution: Discover the data you want to add alert to it in index. Save the query. Create a monitor based on query and change the default format to epoch_millis. [Screen Shot 2022-01-06 at 8.59.21] { "size": 500, "query": { "bool": { "filter": [ { "match_all": { "boost": 1 } }, { "exists": { "fie…

And I had to add this to my message-field:

“Message”:{“type”:“text”,
“fields”:{“keyword”:{“type”:“keyword”,
“ignore_above”:256}},
“fielddata”:true},

Hope, it helps.