# Elast alert substring

**URL:** <https://discuss.elastic.co/t/elast-alert-substring/379329>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 19, 2025, 2:14pm UTC](https://discuss.elastic.co/t/elast-alert-substring/379329 "2025-06-19T14:14:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elastic\_interogation](https://avatars.discourse-cdn.com/v4/letter/e/d78d45/32.png) [@elastic\_interogation](https://discuss.elastic.co/u/elastic_interogation)\
**Post date:** [June 19, 2025, 2:14pm UTC](https://discuss.elastic.co/t/elast-alert-substring/379329/1 "2025-06-19T14:14:19Z")

</div>

Hello,

I am trying to parse my alerts, I want to get only a substring of a field (my field name is message).

Let me give you an example, actually, I use:

```auto
{
  "text": """
{{#context.hits}}
  - {{_source.message}}
{{/context.hits}}"""
}

```

And that display:

- my first message12345
- my second message56537

But I want only to select the 12 last character of each message, the result should be:

- message12345
- message56537

How can I do that, I have tried substring(12) but it is not working.

Any ideas ?  
Many thanks

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [June 19, 2025, 2:48pm UTC](https://discuss.elastic.co/t/elast-alert-substring/379329/2 "2025-06-19T14:48:04Z")

</div>

Hello @elastic_interogation

I believe the easiest way will be to have an ingest pipeline and save the last 12 characters in a new field message\_alert & this field you can use in your alerting.

Thanks!!