# Call a Value of a Field in alert message

**URL:** https://discuss.elastic.co/t/call-a-value-of-a-field-in-alert-message/360589
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [May 31, 2024, 3:12am UTC](https://discuss.elastic.co/t/call-a-value-of-a-field-in-alert-message/360589 "2024-05-31T03:12:33Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)
#### Post date: [May 31, 2024, 3:12am UTC](https://discuss.elastic.co/t/call-a-value-of-a-field-in-alert-message/360589/1 "2024-05-31T03:12:33Z")

</div>

Hi there,

I'm using ELK 8.11.2  
I have a use case about alerting and I found the type rule that matches perfectly with my use case, now I have created an alert using a custom threshold type rule but the problem is I can't call a field value like when I use the elasticsearh query type rule by using context.hits

I tried to do the same thing here but it gives me nothing in the message when the rule is firing. here is a snippet of the alert message. the point where I tried to call a field value

```auto
{
                    "short":true,
                    "title":"Container name",
                    "value":"{{#context.hits}} {{_source.kubernetes.container.name.keyword}} {{/context.hits}}"
                }

```

I found [this](https://www.elastic.co/guide/en/kibana/8.11/rule-type-es-query.html#_add_action_variables_2)documentation that said context.hits is only for elasticsearch query type rule and I can't find documentation to do that using custom threshold type rule.

Here is the overview of my rule. the aggregation is document count, the threshold is 2 and I grouped it by kubernete.container.name field

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f91aafd579bee6418e9f29a9dd71f7a82e5d061d.png)

Can anyone help with this, please?

I know, I can simply make a rule using an elastic query type rule, but if I do that. I would be flooding my cluster with so many rules. so I decided to use this type of rule.

Thanks