# Need Help Configuring Alert Actions to Include Log Data in OpenSearch
**URL:** https://forum.opensearch.org/t/need-help-configuring-alert-actions-to-include-log-data-in-opensearch/18632
**Category:** Alerting
**Created:** [March 29, 2024, 4:13pm UTC](https://forum.opensearch.org/t/need-help-configuring-alert-actions-to-include-log-data-in-opensearch/18632 "2024-03-29T16:13:47Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@joseraeiro2](https://forum.opensearch.org/u/joseraeiro2)
#### Post date: [March 29, 2024, 4:13pm UTC](https://forum.opensearch.org/t/need-help-configuring-alert-actions-to-include-log-data-in-opensearch/18632/1 "2024-03-29T16:13:47Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):
2.12.0
**Describe the issue** :
**Configuration** :
Hi OpenSearch Community,
I’m currently working on setting up alerting in OpenSearch and I’m facing a challenge with configuring alert actions to include specific data from logs in the alert notifications.
I have successfully configured the alert rules and triggers, and the alerts are being generated when the conditions are met. However, I need assistance with including relevant log data in the alert notifications to provide more context to the recipients.
Here’s a simplified version of what I’m trying to achieve:
- When an alert is triggered, I want the alert notification to include certain fields from the log documents that triggered the alert.
- I’m using the Handlebars template language to customize the alert notification body, but I’m unsure how to reference the log data fields within the template.
I’ve searched through the documentation and forums but haven’t found a clear example or guidance on how to accomplish this. Can someone please provide some pointers or examples on how to achieve this?
Any help or advice would be greatly appreciated. Thank you in advance for your assistance!
**Relevant Logs or Screenshots** :
---
### Author:  [@joseraeiro2](https://forum.opensearch.org/u/joseraeiro2)
#### Post date: [April 2, 2024, 8:18am UTC](https://forum.opensearch.org/t/need-help-configuring-alert-actions-to-include-log-data-in-opensearch/18632/2 "2024-04-02T08:18:55Z")
By the way, this is my query:
```auto
{
"query": {
"bool": {
"must": [
{
"terms": {
"data.win.system.eventID": [
"4720",
"4722"
],
"boost": 1
}
},
{
"range": {
"@timestamp": {
"from": "now-9m",
"to": "now",
"include_lower": true,
"include_upper": true,
"boost": 1
}
}
}
],
"adjust_pure_negative": true,
"boost": 1
}
}
}
```
And this is my trigger condition:
```auto
// Create sets to store targetUserNames for each event ID
Set enabled_users = new HashSet();
Set created_users = new HashSet();
// Loop through each log entry in the search results
for (int i = 0; i < ctx.results[0].hits.hits.length; i++) {
String eventID = ctx.results[0].hits.hits[i]._source.data.win.system.eventID;
String targetUserName = ctx.results[0].hits.hits[i]._source.data.win.eventdata.targetUserName;
// Exclude usernames that end with '$'
if (targetUserName.endsWith("$")) {
continue;
}
if (eventID.equals("4720")) {
created_users.add(targetUserName);
} else if (eventID.equals("4722")) {
enabled_users.add(targetUserName);
}
}
// Check if there are any users that are in the 'enabled_users' set but not in the 'created_users' set
for (String user : enabled_users) {
if (!created_users.contains(user)) {
return true; // Trigger the alert
}
}
return false; // Do not trigger the alert
```
I would like to pass along the data.win.eventdata.targetUserName field in the Alert Action.
---
### Author:  [@joseraeiro2](https://forum.opensearch.org/u/joseraeiro2)
#### Post date: [April 5, 2024, 3:25pm UTC](https://forum.opensearch.org/t/need-help-configuring-alert-actions-to-include-log-data-in-opensearch/18632/3 "2024-04-05T15:25:40Z")
Perhaps something along these lines?
```auto
{
"size": 500,
"query": {
"bool": {
"must": [
{
"terms": {
"data.win.system.eventID": [
"4720",
"4722"
],
"boost": 1
}
},
{
"range": {
"@timestamp": {
"from": "now-9m",
"to": "now",
"include_lower": true,
"include_upper": true,
"boost": 1
}
}
}
],
"adjust_pure_negative": true,
"boost": 1
}
},
"_source": ["data.win.eventdata.targetUserName", "data.win.system.eventID", "@timestamp"],
"stored_fields": ["data.win.eventdata.targetUserName", "data.win.system.eventID", "@timestamp"],
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
},
{
"field": "data.win.eventdata.targetUserName"
}
],
"sort": [
{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
]
}
```
And this?
```auto
Monitor {{ctx.monitor.name}} just entered ALERT status. Please investigate the issue.
- Alert time: {{ctx.periodStart}}
> User Name: {{_source.data.win.eventdata.targetUserName}}
```
---
### Author:  [@Gsmitt](https://forum.opensearch.org/u/Gsmitt)
#### Post date: [April 10, 2024, 2:08am UTC](https://forum.opensearch.org/t/need-help-configuring-alert-actions-to-include-log-data-in-opensearch/18632/4 "2024-04-10T02:08:59Z")
Hey @joseraeiro2
Correct me if I’m wrong, but you would like more details about the alert in the Notification sent?
Example:
I found that adding this to my query
```auto
"exists": {
"field": "winlog.event_data.SubjectUserName",
"boost": 1
}
```
Then I would add that field to my Message section…
```auto
Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.
- Trigger: {{ctx.trigger.name}}
- Severity: {{ctx.trigger.severity}}
- Period start: {{ctx.periodStart}}
- Period end: {{ctx.periodEnd}}
- username: {{_source.winlog.event_data.SubjectUserName}}
```
Email Results:
```auto
> 2
> gsmith.domain.com
> greg.smith
```
This post might help.
> [@How do i include message fields in the Alert Action Message](https://forum.opensearch.org/t/how-do-i-include-message-fields-in-the-alert-action-message/8167):
>
> Hello, I use OpenSearch for logs from docker containers. I created an alert to Slack and would like to include logs message fields inside the Alert Action Message, For example here is my lo JSON that i would like to take some fields from it(like container\_name) and include them into Action Message to be send to slack. [Screen Shot 2022-01-02 at 16.13.25] Currently my Action Message is the default one. Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue. M…
---
### Author:  [@joseraeiro2](https://forum.opensearch.org/u/joseraeiro2)
#### Post date: [April 10, 2024, 8:28am UTC](https://forum.opensearch.org/t/need-help-configuring-alert-actions-to-include-log-data-in-opensearch/18632/5 "2024-04-10T08:28:33Z")
> [@Gsmitt](#):
>
> Correct me if I’m wrong, but you would like more details about the alert in the Notification sent?
No, you are absolutely correct, Sir!
Are you suggesting that I use something like:
```auto
{
"query": {
"bool": {
"must": [
{
"terms": {
"data.win.system.eventID": [
"4720",
"4722"
],
"boost": 1
}
},
{
"range": {
"@timestamp": {
"from": "now-9m",
"to": "now",
"include_lower": true,
"include_upper": true,
"boost": 1
}
}
},
{
"exists": {
"field": "data.win.eventdata.targetUserName",
"boost": 1
}
}
],
"adjust_pure_negative": true,
"boost": 1
}
}
}
```
And then this:
```auto
Monitor {{ctx.monitor.name}} just entered ALERT status. Please investigate the issue.
- Alert time: {{ctx.periodStart}}
> User Name: {{_source.data.win.eventdata.targetUserName}}
```
---
### Author:  [@system](https://forum.opensearch.org/u/system)
#### Post date: [June 9, 2024, 8:29am UTC](https://forum.opensearch.org/t/need-help-configuring-alert-actions-to-include-log-data-in-opensearch/18632/6 "2024-06-09T08:29:28Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.