# Alert is not populating the right fields **URL:** \ **Category:** Elastic Security\ **Created:** [August 23, 2022, 12:24am UTC](https://discuss.elastic.co/t/alert-is-not-populating-the-right-fields/312663 "2022-08-23T00:24:45Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![aids123](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@aids123](https://discuss.elastic.co/u/aids123)\ **Post date:** [August 23, 2022, 12:24am UTC](https://discuss.elastic.co/t/alert-is-not-populating-the-right-fields/312663/1 "2022-08-23T00:24:46Z")
I am trying to create an alert containing the fields populated(host.name,user.name,file.name,process.name), however when the rule trigger the alert it seems that these are not populated. I was advised that it is because we used our own parser and not aligned with ECS. Are there any fast work around like just renaming the fieldnames upon query so it will populate. ---
**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\ **Post date:** [August 31, 2022, 9:07am UTC](https://discuss.elastic.co/t/alert-is-not-populating-the-right-fields/312663/2 "2022-08-31T09:07:55Z")
Hi, you can look into runtime fields to help you with aligning custom fields fast. But I would suggest you to start work on aligning with ECS as much as possible as it will help you out a lot more in the long term. > **[Runtime fields | Elasticsearch Guide \[8.4\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 28, 2022, 9:08am UTC](https://discuss.elastic.co/t/alert-is-not-populating-the-right-fields/312663/3 "2022-09-28T09:08:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.