Creating an Elasticsearch Alert Email Connector containing "winlog.event_data.TargetUserName"?

Hello Elastic Community,
I Created a Alert type "Elasticsearch query" that looks for a specifc winlog.event_id:"XXXX"
and triggers when threshold it is above "x" value. There is a Email connector all this works perfectly.

the issue:
the Message for the Email contains:

Alert Details:
Event Type: {{fields.winlog.event_data.EventID}}
Target User: - {{fields.winlog.event_data.TargetUserName}}
Event Time: {{fields["@timestamp"]}}
Source IP: {{fields.winlog.event_data.SourceIP}}

Despite the successful triggering of the alert, the message content does not display the expected data. Instead, the placeholders remain empty.

Where im i Going wrong ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.