# Alert and connect mail format error
**URL:** https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998
**Category:** SIEM
**Created:** [April 1, 2021, 8:48am UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998 "2021-04-01T08:48:13Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [April 1, 2021, 8:48am UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998/1 "2021-04-01T08:48:13Z")
Hi all i have some question
I was trying the version 7.12 for the first time, what interest me the most was that kibana finally have mail format for the siem rule, well i try cortext.alert just like how they show on github and it didn't work it doesnot show any thing on the mail, the cortext part does not event show up on the mail.
Can anyone help me!
Thanks for your time.
---
### Author:  [@austinsonger](https://discuss.elastic.co/u/austinsonger)
#### Post date: [April 1, 2021, 5:02pm UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998/2 "2021-04-01T17:02:22Z")
Can you show what your connector looks like?
---
### Author:  [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [April 2, 2021, 1:12am UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998/3 "2021-04-02T01:12:37Z")
my connector are just onprem exchange server which basically config as normal connector.
I really dont know how that could cause the problems
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 2, 2021, 3:18am UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998/4 "2021-04-02T03:18:12Z")
Hi @lusynda
We are just asking questions because you did not give us much if any information to go on.
So we start with the most basic question, does the connector work?
Did you send a test email from the connector? Did it work? If so great then we can move on.
Can you show was which github repo you are referring to?
Can you share you configuration of the rule and action?
Perhaps someone can help if you do that.
---
### Author:  [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [April 2, 2021, 3:37am UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998/5 "2021-04-02T03:37:38Z")
Oh ok so the connector work i have test it and i did get the mail from kibana.
The mail that i got from kibana just lack the whole part where the information should be
The alert mail i send out is like this:
```auto
test {{something}} test {{some}}
```
The mail i receive are just:
```auto
test test
```
I follow exacly what the main page on kibana say on this link:
>
>
> Resolves https://github.com/elastic/kibana/issues/61313
>
> \## Summary
>
> New sta…ck alert for executing ES DSL (query only, no aggregation support) and evaluating the number of matches against a threshold condition.
>
> \### UI
> Alert params expression contains a JSON editor allowing users to enter query DSL and test their query. Screenshots attached.
>
> \
> \ Search alert in alert types list \
> \
> \
>
> \
> \ Search alert params \
> \
> \
>
> \
> \ Test query success \
> \
> \
>
> \
> \ Test query failure \
> \
> \
>
> \### Alert executor
> Each run of the alert executor builds an ES query with the user-defined query clause and the user defined time window relative to the date/time of the alert execution. In order to avoid counting a single document multiple times during multiple executions of the alert, we keep track of the timestamp of the last document that matched a threshold condition. This is passed through the alert state and used during the next execution as an additional filter for the query.
>
> \### Action context
> Matching documents are passed through to actions using \`context.hits\`. This can be used with mustache templates to create a message for each matching document containing information about that document.
>
> \ Example action message \
>
> \`\`\`
> You have {{context.value}} matches!
> {{#context.hits}}
> Document with {{\_id}} and hostname {{\_source.host.name}} has {{\_source.system.memory.actual.free}} bytes of memory free
> {{/context.hits}}
> \`\`\`
>
> \
> \ Resulting Slack Notification \
> \
> \
>
> \### Docs
> \
> \ Documentation \
> \
> \
> \
> \
>
> \### Checklist
>
> Delete any items that are not applicable to this PR.
>
> \- \[x\] Any text added follows \[EUI's writing guidelines\](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes \[i18n support\](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)
> \- \[x\] \[Documentation\](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
> \- \[x\] \[Unit or functional tests\](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
> \- \[x\] Any UI touched in this PR is usable by keyboard only (learn more about \[keyboard accessibility\](https://webaim.org/techniques/keyboard/))
> \- \[x\] Any UI touched in this PR does not create any new axe failures (run axe in browser: \[FF\](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), \[Chrome\](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
> \- \[x\] This renders correctly on smaller devices using a responsive layout. (You can test this \[in your browser\](https://www.browserstack.com/guide/responsive-testing-on-local-server))
> [@stephenb](#):
>
> Can you share you configuration of the rule and action?
The rule that i have are very general thing it just search for a string for testing purpose only so it should always have hit.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 2, 2021, 3:52am UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998/6 "2021-04-02T03:52:47Z")
> [@lusynda](#):
>
> The mail that i got from kibana just lack the whole part where the information should be
> The alert mail i send out is like this:
>
> Copy to clipboard
>
> ```auto
> test {{something}} test {{some}}
>
> ```
>
> The mail i receive are just:
>
> Copy to clipboard
>
> ```auto
> test test
>
> ```
If that is from the connector test then that is exactly correct.
The `{{something}}` syntax mean substitute the value of the field `something` . Since in connector test the is no actual alert data then the is no actual field `something` so there is no value to substitute thus result is no value / empty string.
If you would actually show me the alert / rule and action I may be able to help, If not there is no way to help.
Show us the rule a screenshot something... Not sure how we can help with no info
---
### Author:  [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [April 2, 2021, 4:14am UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998/7 "2021-04-02T04:14:09Z")
Here is my rule set
And here is the alert that i config
Hope this help
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 2, 2021, 6:44am UTC](https://discuss.elastic.co/t/alert-and-connect-mail-format-error/268998/8 "2021-04-02T06:44:30Z")
So I think your main issue is you are using `context.hits` instead of `context.alerts` for the loop.
You need to use the correct syntax and available fields see [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-action-variables) they can be found with the menu on the left.
Assuming you Did Preview Results it did it show matches / Detection
 ?
You need to use the available fields see [here](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-action-variables) they can be found with the menu on the right.
Put in `{{context.alerts}}` that will give you a sense of the data / structure.
Also only fields available in the docs will be available... not every docs that is detected will have the same fields, you can check the fields in discover
Here is my sample action
```
Rule {{context.rule.name}} generated {{state.signals_count}} alerts
{{#context.alerts}}