Hello Elastic Community,
I Created a Alert type "Elasticsearch query" that looks for a specifc winlog.event_id:"XXXX"
and triggers when threshold it is above "x" value. There is a Email connector all this works perfectly.
the issue:
the Message for the Email contains:
Alert Details:
---------------------
Event Type: {{fields.winlog.event_data.EventID}}
Target User: - {{fields.winlog.event_data.TargetUserName}}
Event Time: {{fields["@timestamp"]}}
Source IP: {{fields.winlog.event_data.SourceIP}}
Despite the successful triggering of the alert, the message content does not display the expected data. Instead, the placeholders remain empty.
Where im i Going wrong ?