# Custom Threshold Rule - Email Body

**URL:** <https://discuss.elastic.co/t/custom-threshold-rule-email-body/355055>\
**Category:** Elastic Observability\
**Tags:** elastic-stack-alerting\
**Created:** [March 8, 2024, 6:24pm UTC](https://discuss.elastic.co/t/custom-threshold-rule-email-body/355055 "2024-03-08T18:24:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [March 8, 2024, 6:24pm UTC](https://discuss.elastic.co/t/custom-threshold-rule-email-body/355055/1 "2024-03-08T18:24:35Z")

</div>

Hello,  
I created an alert and the alert works as expected.

I have been asked to provide more customization inside the email body.  
Currently the default email body are:

```auto
{{context.reason}}

{{rule.name}} is active.

[View alert details]({{context.alertDetailsUrl}})

```

Output:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8dc9b90e16749c5d75384d7902afe7af3dbd1b50.png)

I want to break up the reason to be more custom like  
Desired Email Body:  
`Due to duration of {{for_last}} minutes, The {{group}} was in a state of {{condition}}`

Desired Output:

> Due to duration of 5 minutes, The "Offline Files" was in a state of "Stopped"

Is there a way to break up {{context.reason}}?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 8, 2024, 11:04pm UTC](https://discuss.elastic.co/t/custom-threshold-rule-email-body/355055/2 "2024-03-08T23:04:14Z")

</div>

What I do is just print `{{.}}` for debug.  
that will print everything and then I just piece together what I want... but no there is not facility as far as I know to pull apart the string in each field.

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [March 8, 2024, 11:12pm UTC](https://discuss.elastic.co/t/custom-threshold-rule-email-body/355055/3 "2024-03-08T23:12:28Z")

</div>

Thanks! @stephenb

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2024, 11:13pm UTC](https://discuss.elastic.co/t/custom-threshold-rule-email-body/355055/4 "2024-04-05T23:13:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.