# Kibana email alert - extracting field results

**URL:** <https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606>\
**Category:** Alerting\
**Tags:** troubleshoot\
**Created:** [August 26, 2020, 2:56pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606 "2020-08-26T14:56:42Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [August 27, 2020, 9:20pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/21 "2020-08-27T21:20:36Z")

</div>

I did a [test configuration above](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/18) using the ‘query’ and ‘chart’. With the ‘query’ I got all required fileds in the messages but with ‘chart’ no, like in your case. It should be investigated why - maybe it is not supported at all.

For you case you can create a test Monitor with the following data:

> **Query**
>
> ```auto
> {
> "size": 1000,
> "query": {
> "bool": {
> "filter": [
> {
> "range": {
> "@timestamp": {
> "from": "{{period_end}}||-10h",
> "to": "{{period_end}}",
> "include_lower": true,
> "include_upper": true,
> "format": "epoch_millis",
> "boost": 1
> }
> }
> },
> {
> "match_phrase": {
> "product": {
> "query": "*Mobile Access*",
> "slop": 0,
> "zero_terms_query": "NONE",
> "boost": 1
> }
> }
> },
> {
> "match_phrase": {
> "status": {
> "query": "failure",
> "slop": 0,
> "zero_terms_query": "NONE",
> "boost": 1
> }
> }
> }
> ],
> "adjust_pure_negative": true,
> "boost": 1
> }
> },
> "aggregations": {}
> }
> 
> ```

And then create a Trigger with the alert and use ctx iteration in the message.

---

<div class="post-metadata">

**Author:** ![lehner.angelica](https://avatars.discourse-cdn.com/v4/letter/l/48db29/32.png) [@lehner.angelica](https://forum.opensearch.org/u/lehner.angelica)\
**Post date:** [August 28, 2020, 2:53pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/22 "2020-08-28T14:53:19Z")

</div>

Thanks @stmx38 !!

This actually solved it 🙂  
I really appreciate your time and help.

Best regards.

---

<div class="post-metadata">

**Author:** ![lehner.angelica](https://avatars.discourse-cdn.com/v4/letter/l/48db29/32.png) [@lehner.angelica](https://forum.opensearch.org/u/lehner.angelica)\
**Post date:** [August 28, 2020, 6:15pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/23 "2020-08-28T18:15:23Z")

</div>

Hey @stmx38

Could you kindly assist me with writing a query for a monitor that is using more than two terms that one of them is “NOT” X, for example:

 ![Query](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/1X/ce5a6dce5b939de2ff4093fccd4156b93e87f899.jpeg)

That is what I wrote (as far as I understand on how it should work):

```
{
    "size": 1000,
    "query": {
        "bool": {
            "filter": [
                {
                    "range": {
                        "@timestamp": {
                            "from": "{{period_end}}||-1m",
                            "to": "{{period_end}}",
                            "include_lower": true,
                            "include_upper": true,
                            "format": "epoch_millis",
                            "boost": 1
                        }
                    }
                },
                {
                    "match_phrase": {
                        "product": {
                            "query": "*IPS*",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                },
                    {
                    "match_phrase": {
                        "not action": {
                            "query": "*drop*",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                },
                {
                    "match_phrase": {
                        "dst": {
                            "query": "10.10.10.10",
                            "slop": 0,
                            "zero_terms_query": "NONE",
                            "boost": 1
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    },
    "aggregations": {}
}

```

Is that correct?

Also, is there an easy-to-understand documentation on writing queries?

Thanks again!

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [August 28, 2020, 7:50pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/24 "2020-08-28T19:50:13Z")

</div>

Your filter in KQL looks like:  
`product: "*IPS*"` AND dst: “172.16.11.1” AND NOT action: “drop”`

> **In full-text query it may look like this one**
>
> ```auto
> {
> "size": 1000,
> "query": {
> "bool": {
> "filter": [
> {
> "range": {
> "@timestamp": {
> "from": "{{period_end}}||-1m",
> "to": "{{period_end}}",
> "include_lower": true,
> "include_upper": true,
> "format": "epoch_millis",
> "boost": 1
> }
> }
> },
> {
> "match_phrase": {
> "product": {
> "query": "*IPS*",
> "slop": 0,
> "zero_terms_query": "NONE",
> "boost": 1
> }
> }
> },
> {
> "match_phrase": {
> "dst": {
> "query": "172.16.11.1",
> "slop": 0,
> "zero_terms_query": "NONE",
> "boost": 1
> }
> }
> }
> ],
> "must_not": [
> {
> "match": {
> "action": {
> "query": "*drop*",
> "prefix_length": 0,
> "max_expansions": 50,
> "fuzzy_transpositions": true,
> "lenient": false,
> "zero_terms_query": "NONE",
> "auto_generate_synonyms_phrase_query": true,
> "boost": 1
> }
> }
> }
> ],
> "adjust_pure_negative": true,
> "boost": 1
> }
> },
> "aggregations": {}
> }
> 
> ```

In the Discover we can see our current query in the full-text form inside: `Inspect --> Request`:

 ![Screenshot 2020-08-28 at 22.51.28](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/1X/6c2b2d6a7f2eeba5dd47ffa254e6615a83ebcf0b.png)

Some additional documentation can be found here:

1. [Full-text queries](https://opendistro.github.io/for-elasticsearch-docs/docs/elasticsearch/full-text/)
2. [Full text queries](https://www.elastic.co/guide/en/elasticsearch/reference/current/full-text-queries.html)

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [August 28, 2020, 8:08pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/25 "2020-08-28T20:08:07Z")

</div>

On the creen you provided I see 3 conditions and it looks like it is done in the process of the Monitor definition.

In my Kibana I didn’t find a way to configure more than one condition:

 ![Screenshot 2020-08-28 at 23.07.06](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/1X/600d7ec2dc843a3512a7a2abedead33e8165f4d7.png)

How did you do it?

---

<div class="post-metadata">

**Author:** ![lehner.angelica](https://avatars.discourse-cdn.com/v4/letter/l/48db29/32.png) [@lehner.angelica](https://forum.opensearch.org/u/lehner.angelica)\
**Post date:** [August 29, 2020, 1:58pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/26 "2020-08-29T13:58:37Z")

</div>

Hey @stmx38,

Thanks!

Regarding the 3 conditions,  
I just typed it in the last box, it was working and showed hits.

Regarding full-text query of:  
product: “_IPS_”` AND dst: “x.x.x.x” AND NOT action: “drop”

If I want to write “contains” instead of “is”, what do i need to change in the code above?

Thanks again, much appreciation.

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [August 29, 2020, 3:40pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/27 "2020-08-29T15:40:59Z")

</div>

Will this work?

**contains**

```auto
"product": {
    "query": "*IPS*"

```

**is**

```auto
"dst": {
    "query": "10.10.10.10"

```

---

<div class="post-metadata">

**Author:** ![Serge](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@Serge](https://forum.opensearch.org/u/Serge)\
**Post date:** [September 1, 2020, 6:42am UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/28 "2020-09-01T06:42:49Z")

</div>

Hi folks.  
JFYI: in discovery tab you can setup all the filters you need in Alert. Then you can click “Inspet” - “Request” copy request and modify it.

---

<div class="post-metadata">

**Author:** ![Mr\_Hedgehog](https://avatars.discourse-cdn.com/v4/letter/m/74df32/32.png) [@Mr\_Hedgehog](https://forum.opensearch.org/u/Mr_Hedgehog)\
**Post date:** [April 16, 2021, 9:10am UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/29 "2021-04-16T09:10:57Z")

</div>

Hi there,

I know some time has now past, but I believe the issue with using the visual graph to define the query is that it sets the return size to 0 so there is no result set to iterate over. However there is no option to change this from the graph page.

If you define the query with the visual graph and then switch to the the extraction query you can alter the “size”: 0 to “size”: 1000 and you should see the result set come back in the “hits”.

It is annoying this seems to be the default behavior when using the visual method.

You can see exactly what is being stored when using the visual graph by using ```  
GET \_opendistro/\_alerting/monitors/\<monitor\_id\>

```auto

```

---

<div class="post-metadata">

**Author:** ![joicyfroit](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@joicyfroit](https://forum.opensearch.org/u/joicyfroit)\
**Post date:** [July 11, 2021, 10:57am UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/30 "2021-07-11T10:57:07Z")

</div>

I know even more time has passed. But I just created an account to thank you for this post that ended hours of me pulling my hair out in attempts to solving this puzzle. Thank you so much.

---

<div class="post-metadata">

**Author:** ![chidex](https://avatars.discourse-cdn.com/v4/letter/c/ecc23a/32.png) [@chidex](https://forum.opensearch.org/u/chidex)\
**Post date:** [November 10, 2021, 1:50pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/31 "2021-11-10T13:50:05Z")

</div>

I have struggled with this alert thing with moustache for months with no clear examples in documentation to guide but stumbling into this saved the months. Thanks a lot stmx38

---

<div class="post-metadata">

**Author:** ![pitch](https://avatars.discourse-cdn.com/v4/letter/p/e99b99/32.png) [@pitch](https://forum.opensearch.org/u/pitch)\
**Post date:** [December 4, 2021, 9:06pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/32 "2021-12-04T21:06:04Z")

</div>

this information is absolutely missing in the opensearch documentation  
i can’t remember reading about the ctx \_source

earlier when getting in touch with opensource projects it was mostly RTFM  
sadly, today it looks like it’s RTFC  
that’s not userfriendly  
what happened  
kudos @stmx38

---

<div class="post-metadata">

**Author:** ![divyank](https://avatars.discourse-cdn.com/v4/letter/d/f0a364/32.png) [@divyank](https://forum.opensearch.org/u/divyank)\
**Post date:** [December 7, 2021, 12:06pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/33 "2021-12-07T12:06:47Z")

</div>

Hi All and @stmx38,

Thanks for sharing your observations here.

I am able to get values by using the below moustache, but math operations are not performed on it.I don’t have null values in trigger condition.

moustache-

```auto
- Trigger: {{ctx.trigger.name}}
- Severity: {{ctx.trigger.severity}}
- Period {{ctx.periodStart}} - {{ctx.periodEnd}}
- Period start: {{ctx.periodStart}}
- Period end: {{ctx.periodEnd}}
- Total logs: {{ctx.track_total_hits}}
-Total Logs: {{ctx.results.0.hits.total.value}}
-Undelivered Logs:{{ctx.results.0.aggregations.when.sum_other_doc_count}}
-Hi : {{ctx.results.0.hits.total.value}} - {{ctx.results.0.aggregations.when.sum_other_doc_count}}
-Delivered Logs: {{ctx.results.0.hits.total.value}}/{{ctx.results.0.aggregations.when.sum_other_doc_count}}

```

output-

```auto
- Trigger: Undelivered Message Alert
- Severity: 1
- Period 2021-12-07T11:40:43Z - 2021-12-07T11:41:43Z
- Period start: 2021-12-07T11:40:43Z
- Period end: 2021-12-07T11:41:43Z
- Total logs: 
-Total Logs: 277502
-Undelivered Logs:48584
-Hi : 277502 - 48584
-Delivered Logs: 277502/48584

```

Snap-

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/1/16fc7cabdb3e57b45a13b9225ce2b9a22d2e14c3.png)

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [December 7, 2021, 5:31pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/34 "2021-12-07T17:31:44Z")

</div>

Hello @divyank, what do you mean about math operations?

> -Delivered Logs: 277502/48584

Should be like this?  
`-Delivered Logs: 5.7`

`277502 / 48584 ~ 5.7`

---

<div class="post-metadata">

**Author:** ![divyank](https://avatars.discourse-cdn.com/v4/letter/d/f0a364/32.png) [@divyank](https://forum.opensearch.org/u/divyank)\
**Post date:** [December 7, 2021, 5:37pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/35 "2021-12-07T17:37:41Z")

</div>

yes @stmx38, like addition,subtraction, etc

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [December 7, 2021, 6:01pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/36 "2021-12-07T18:01:52Z")

</div>

Maybe something like this?  
`{{ ctx.results.0.hits.total.value / ctx.results.0.aggregations.when.sum_other_doc_count }}`

---

<div class="post-metadata">

**Author:** ![divyank](https://avatars.discourse-cdn.com/v4/letter/d/f0a364/32.png) [@divyank](https://forum.opensearch.org/u/divyank)\
**Post date:** [December 7, 2021, 6:41pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/37 "2021-12-07T18:41:22Z")

</div>

> [@stmx38](#):
>
> {{ ctx.results.0.hits.total.value / ctx.results.0.aggregations.when.sum\_other\_doc\_count }}

I checked wit it but it’s showing blank values, may be math operations is not possible in moustache’s/

```auto
- Hi: {{ ctx.results.0.hits.total.value / ctx.results.0.aggregations.when.sum_other_doc_count }}

Output-
- Hi: 

```

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/6/65e877a5df1d1543002fdeaec5c0482157439f5b.png)

---

<div class="post-metadata">

**Author:** ![manchou101](https://avatars.discourse-cdn.com/v4/letter/m/dfb087/32.png) [@manchou101](https://forum.opensearch.org/u/manchou101)\
**Post date:** [February 10, 2022, 9:44am UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/38 "2022-02-10T09:44:16Z")

</div>

@lehner.angelica Hi, I am new to ELK and using opendistro Kibana and trying to sent email alerts using custom webhooks as destination. Could you please help me in configuring a custom webhook using an SMTP server ?

Much appreciated 🙂

---

<div class="post-metadata">

**Author:** ![shaimoh](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shaimoh](https://forum.opensearch.org/u/shaimoh)\
**Post date:** [March 2, 2022, 7:07pm UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/39 "2022-03-02T19:07:38Z")

</div>

Hi Angelica,

Good day to you… Im kinda stuck on an issue you once faced during creating alerts in opendistro kibana.

basically, im trying to get the message to come along with the alert when its triggered

```auto
{{#ctx.results.0.hits.hits}}
Username: {{_source.user}}
{{/ctx.results.0.hits.hits}}

```

tried this and did not work…Any advise how you fixed it ? Im using the extraction query to create the alert

---

<div class="post-metadata">

**Author:** ![sateesh](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sateesh](https://forum.opensearch.org/u/sateesh)\
**Post date:** [March 10, 2022, 6:24am UTC](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606/40 "2022-03-10T06:24:14Z")

</div>

@shaimoh share ur query and response which you used to extract bcz recently i did it if i know i will help you in this…

[Previous page](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606.md?page=1)

[Next page](https://forum.opensearch.org/t/kibana-email-alert-extracting-field-results/3606.md?page=3)