# Elasticsearch query type alert in kibana alerts

**URL:** <https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [May 25, 2021, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921 "2021-05-25T11:16:59Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Priyanka\_chauhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priyanka_chauhan/32/86146_2.png) [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\
**Post date:** [May 25, 2021, 11:16am UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921/1 "2021-05-25T11:16:59Z")

</div>

I am creating elasticsearch query type alerts in Kibana Alerts and Action section. I have put a condition to send an alert when blacklist IP met with threshold condition in my query.  
Alerts are generated in index with predefined variables only. Is it possible to add some additional fields in notification message from index on which query is applied ? for eg: I am using destination.ip in my query as a blacklist ip and I want to add destination.ip field in notification message. My document to index in alert is below:

{  
"log\_type": "Packetbeat",  
"context\_message": "This is destination IP{{context.message}}",  
"alert\_id": "{{alertId}}",  
"destination.ip": "{{destination.ip}}",  
"alert\_name": "{{alertName}}",  
"alert\_instance\_id": "{{alertInstanceId}}"  
}

I tried above query but "destination.ip": "{{destination.ip}}", is stroring empty data.

Thanks

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [May 25, 2021, 11:35pm UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921/2 "2021-05-25T23:35:15Z")

</div>

Can you share a sample doc? Mappings?  
Thanks

---

<div class="post-metadata">

**Author:** ![Priyanka\_chauhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priyanka_chauhan/32/86146_2.png) [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\
**Post date:** [May 27, 2021, 3:48am UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921/3 "2021-05-27T03:48:03Z")

</div>

This is mapping doc for my alert, I want to add IP in my alert index.  
{  
"alert\_test" : {  
"mappings" : {  
"properties" : {  
"@timestamp" : {  
"type" : "date"  
},  
"alert\_id" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"alert\_instance\_id" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"alert\_name" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"context\_message" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"destination" : {  
"properties" : {  
"ip" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
}  
}  
},  
"ip\_addr" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
},  
"log\_type" : {  
"type" : "text",  
"fields" : {  
"keyword" : {  
"type" : "keyword",  
"ignore\_above" : 256  
}  
}  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [May 27, 2021, 3:59am UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921/4 "2021-05-27T03:59:25Z")

</div>

> [@Priyanka\_chauhan](#):
>
> destination.ip

Did you try `destination.ip.keyword`?

---

<div class="post-metadata">

**Author:** ![Priyanka\_chauhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priyanka_chauhan/32/86146_2.png) [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\
**Post date:** [May 27, 2021, 4:31am UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921/5 "2021-05-27T04:31:38Z")

</div>

yes this IP I want to fetch from logs index to alert index

---

<div class="post-metadata">

**Author:** ![Priyanka\_chauhan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/priyanka_chauhan/32/86146_2.png) [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\
**Post date:** [May 27, 2021, 4:46am UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921/6 "2021-05-27T04:46:14Z")

</div>

Yes I tried that too then it was going blank

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 24, 2021, 4:46am UTC](https://discuss.elastic.co/t/elasticsearch-query-type-alert-in-kibana-alerts/273921/7 "2021-06-24T04:46:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.