# Elastic Alerting

**URL:** <https://discuss.elastic.co/t/elastic-alerting/374474>\
**Category:** Elastic Security\
**Created:** [February 13, 2025, 5:39am UTC](https://discuss.elastic.co/t/elastic-alerting/374474 "2025-02-13T05:39:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![amarasinghe.kaluarac](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\
**Post date:** [February 13, 2025, 5:39am UTC](https://discuss.elastic.co/t/elastic-alerting/374474/1 "2025-02-13T05:39:25Z")

</div>

Hi all,

I am creating a alerting system with elastic connectors , so far now i am able to send alerts to telegrame via a bot but the issue is the details of the alerts for a example:

I have a rule for firewall login failure and i need to send the alert with who failed to login like if user A failed to login alert should be \<\< Elastic Alert: Firewall Login Failure , user A failed to login to the firewall \>\>

but it seems i cannot includ the username field to the alert data

 ![Screenshot 2025-02-13 104754](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e2279fadc5d74c59a2cc93d65d02e948ebf8ddb0.png)

I uploaded a screenshot of the body of the connection action  
I bit confused with this variables that is available in this , what are they from where they get can i create a new variable?

I am hoping that someone can help me with this

Thank you

---

<div class="post-metadata">

**Author:** ![amarasinghe.kaluarac](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\
**Post date:** [February 13, 2025, 6:34am UTC](https://discuss.elastic.co/t/elastic-alerting/374474/2 "2025-02-13T06:34:15Z")

</div>

Update:  
So I found info about this on [Elastic Rule Action variable](https://www.elastic.co/guide/en/kibana/current/rule-action-variables.html) page But it seems that I cannot create new variables I could not found any info about it also some fields did not worked for me for a example

` **documents** _[view in Discover]({{{context.link}}})_`

above context also did not worked .

I will upload a screnshot of the alert I get via telegrame for review

 ![Image (3)](https://us1.discourse-cdn.com/elastic/original/3X/3/9/39cc90fb1aa0f472b2724c65bbc37a35578b40fe.png)

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2025, 6:34am UTC](https://discuss.elastic.co/t/elastic-alerting/374474/3 "2025-03-13T06:34:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.