# New line in mustache template for destination

**URL:** <https://forum.opensearch.org/t/new-line-in-mustache-template-for-destination/458>\
**Category:** Alerting\
**Created:** [April 18, 2019, 12:41pm UTC](https://forum.opensearch.org/t/new-line-in-mustache-template-for-destination/458 "2019-04-18T12:41:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nishant](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@Nishant](https://forum.opensearch.org/u/Nishant)\
**Post date:** [April 18, 2019, 12:41pm UTC](https://forum.opensearch.org/t/new-line-in-mustache-template-for-destination/458/1 "2019-04-18T12:41:48Z")

</div>

hey,

Can anyone help me out on how to give newline delimiter using mustache template in the destination block?

Eg:

**Condition configuration:**  
Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.

- Trigger: {{ctx.trigger.name}}
- Severity: {{ctx.trigger.severity}}
- Period start: {{ctx.periodStart}}
- Period end: {{ctx.periodEnd}}

Unhealthy Nodes:  
{{#ctx.results.0.aggregations.hosts.buckets}}Hostname → {{key}} containers → {{#dockers.buckets}}{{key}}, {{/dockers.buckets}}{{/ctx.results.0.aggregations.hosts.buckets}}

**current output:**

Monitor Health check alerts - non kube just entered alert status. Please investigate the issue.

- Trigger: TEST TRIGGER
- Severity: 1
- Period start: 2019-04-18T12:35:53Z
- Period end: 2019-04-18T12:36:53Z

Unhealthy Nodes:  
Hostname → hostname1 containers → container name1, Hostname → hostname2 containers → container name2,

**Desired output:**

Monitor Health check alerts - non kube just entered alert status. Please investigate the issue.

- Trigger: TEST TRIGGER
- Severity: 1
- Period start: 2019-04-18T12:35:53Z
- Period end: 2019-04-18T12:36:53Z

Unhealthy Nodes:  
Hostname → hostname1 containers → container name1,  
Hostname → hostname2 containers → container name2,

Thanks,  
Nishant

---

<div class="post-metadata">

**Author:** ![dbbaughe](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dbbaughe](https://forum.opensearch.org/u/dbbaughe)\
**Post date:** [April 18, 2019, 4:32pm UTC](https://forum.opensearch.org/t/new-line-in-mustache-template-for-destination/458/2 "2019-04-18T16:32:50Z")

</div>

Hi Nishant,

Can you try formatting this part from:

> [@Nishant](#):
>
> {{#ctx.results.0.aggregations.hosts.buckets}}Hostname -\> {{key}} containers -\> {{#dockers.buckets}}{{key}}, {{/dockers.buckets}}{{/ctx.results.0.aggregations.hosts.buckets}}

to

> {{#ctx.results.0.aggregations.hosts.buckets}}  
> Hostname -\> {{key}} containers -\> {{#dockers.buckets}}{{key}}, {{/dockers.buckets}}{{/ctx.results.0.aggregations.hosts.buckets}}

---

<div class="post-metadata">

**Author:** ![Serge](https://avatars.discourse-cdn.com/v4/letter/s/5f8ce5/32.png) [@Serge](https://forum.opensearch.org/u/Serge)\
**Post date:** [May 11, 2019, 7:58am UTC](https://forum.opensearch.org/t/new-line-in-mustache-template-for-destination/458/3 "2019-05-11T07:58:50Z")

</div>

Hello.  
This is a HTML document. So you can use \<.br\>(without dot) to split lines.  
In your case  
{{#ctx.results.0.aggregations.hosts.buckets}}Hostname → {{key}} containers → {{#dockers.buckets}}{{key}}, {{/dockers.buckets}}\<.br\>{{/ctx.results.0.aggregations.hosts.buckets}}  
Remove dot before br.

---

<div class="post-metadata">

**Author:** ![asikarwar](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/asikarwar/32/286_2.png) [@asikarwar](https://forum.opensearch.org/u/asikarwar)\
**Post date:** [September 3, 2019, 3:48pm UTC](https://forum.opensearch.org/t/new-line-in-mustache-template-for-destination/458/4 "2019-09-03T15:48:33Z")

</div>

@Serge @dbbaughe  
I can create the message output using the following:

> triggered Alert for Host: {{\_source.host.name}} with Severity: {{ctx.trigger.severity}} for log level \*{{\_source.log.level}} event\_id: {{\_source.winlog.event\_id}}

But how can i aggregate the alert message output by host and the number/total count of event\_id

**Desired Output:**

- Trigger: Test Trigger if Event\_id count \>= 9
- Severity: 1
- Period start: 2019-09-3T12:35:53Z
- Period end: 2019-09-3T12:36:53Z

**Unhealthy Nodes:**  
Hostname: computer01, Event\_id: 8194, Event\_Count: 20  
Hostname: computer02, Event\_id: 8194 , Event\_Count: 10

**I have the following Query response**

> {  
> “\_shards”: {  
> “total”: 25,  
> “failed”: 0,  
> “successful”: 25,  
> “skipped”: 0  
> },  
> “hits”: {  
> “hits”: [  
> {  
> “\_index”: “winlogbeat-7.1.1-2019.09.03”,  
> “\_type”: “\_doc”,  
> “\_source”: {  
> “agent”: {  
> “hostname”: “computer01”,  
> “id”: “c2be2732-0605-44c4-8f6e-759f4bf29eef”,  
> “type”: “winlogbeat”,  
> “ephemeral\_id”: “26f85118-668f-4fdd-9bfa-90613af50842”,  
> “version”: “7.1.1”  
> },  
> “@timestamp”: “2019-09-03T11:03:45.558Z”,  
> “winlog”: {  
> “record\_id”: 427038,  
> “computer\_name”: “[computer01.corp.test.com](http://computer01.corp.test.com)”,  
> “event\_id”: 8194,  
> “task”: “”,  
> “keywords”: [  
> “Classic”  
> ],  
> “channel”: “Application”,  
> “api”: “wineventlog”,  
> “event\_data”: {  
> “Binary”: “2D20436F64653A20575254575254494330303030313238372D2043616C6C3230”,  
> “param1”: “0x80070005, Access is denied.”,  
> “param2”: “\n\nOperation:\n Gathering Writer Data\n\nContext:\n Writer Class Id: {e8132975}\n Writer Name: System Writer\n Writer Instance ID: {c9162cad-961f}”  
> },  
> “opcode”: “Info”,  
> “provider\_name”: “VSS”  
> },  
> “ecs”: {  
> “version”: “1.0.0”  
> },  
> “log”: {  
> “level”: “error”  
> },  
> “host”: {  
> “hostname”: “computer01”,  
> “os”: {  
> “build”: “17134.885”,  
> “kernel”: “10.0.17134.885 (WinBuild.160101.0800)”,  
> “name”: “Windows 10 Enterprise”,  
> “family”: “windows”,  
> “version”: “10.0”,  
> “platform”: “windows”  
> },  
> “name”: “computer01”,  
> “id”: “81ad8be0-e195-4449-a1ff-94aac008d060”,  
> “architecture”: “x86\_64”  
> },  
> “event”: {  
> “code”: 8194,  
> “created”: “2019-09-03T11:03:45.616Z”,  
> “kind”: “event”  
> },  
> “message”: “Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback }”  
> },  
> “\_id”: “L-rL9mwBaGHd-dxVe1hT”,  
> “sort”: [  
> 1567508625558  
> ],  
> “\_score”: null  
> },

**Currently following is the output**

 ![message_output](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/1X/cc57c9c173d9df8333656920e6ed5e079094c80a.png)

---

<div class="post-metadata">

**Author:** ![skkosuri-amzn](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/skkosuri-amzn/32/935_2.png) [@skkosuri-amzn](https://forum.opensearch.org/u/skkosuri-amzn)\
**Post date:** [November 28, 2020, 10:12pm UTC](https://forum.opensearch.org/t/new-line-in-mustache-template-for-destination/458/5 "2020-11-28T22:12:45Z")

</div>