# Email alert body readable format

**URL:** <https://discuss.elastic.co/t/email-alert-body-readable-format/279344>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [July 22, 2021, 6:26am UTC](https://discuss.elastic.co/t/email-alert-body-readable-format/279344 "2021-07-22T06:26:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![saswatmishra94](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@saswatmishra94](https://discuss.elastic.co/u/saswatmishra94)\
**Post date:** [July 22, 2021, 6:26am UTC](https://discuss.elastic.co/t/email-alert-body-readable-format/279344/1 "2021-07-22T06:26:02Z")

</div>

Hi All ,

I have been recently introduced to ELK and been working on it for last 3-4 weeks . This is a totally new integration we are doing . I have gone through lot of articles which helped me a lot in achieving different areas on alert creation , Anomalies detection , using grok filters and all .

Currently I am working on creating an email alert by using below Elasticsearch Query and I want to trigger an email with readable format , like it should show the regex given in the query along with the matching document count for that particular regex .

```auto
{
  "query": {
    "query_string": {
      "query": "message :\"Logged in is\"~3 or message : \"Attempting login\" "
    }
  }
}

```

I am able to get the full query using {{params.esQuery}} and total document count using {{context.value}} .

But is there a way I can achieve individual regex and its matching document count instead of full query or total count .

For example below which I am using for {{context.hits}} to access the values inside the documents coming in response .

```auto
{{#context.hits}}
Message is == {{_source.message}}
Host Name is == {{_source.host.name}}
{{/context.hits}}

```

Sample Response

`{"_index":"filebeat-7.13.0-2021.07.21","_type":"_doc","_id":"3Yl1yHoB6hcKaN7o-7na","_score":null,"_source":{"host":{"architecture":"x86_64","ip":["10.128.117.83"],"mac":[""],"id":"","name":"","":{"version":"10.0","platform":"windows","family":"windows","build":"","kernel":"","name":"Windows 10 Enterprise","type":"windows"},"hostname":""},"log":{"offset":150083,"file":{"path":""}},"message":"2021-07-21 15:16:48,255 [LoginController.java:hybrisHTTP40:115] - Logged in user is saswatmishra94@gmail.com","tags":["beats_input_codec_plain_applied"],"@version":"1","ecs":{"version":"1.8.0"},"input":{"type":"log"},"agent":{"version":"7.13.0","ephemeral_id":"","id":"183d0f9d-af2a-440f-a9cb-338a60429278","name":"","hostname":"","type":"filebeat"},"@timestamp":"2021-07-21T09:46:50.767Z"},"fields":{"@timestamp":["2021-07-21T09:46:50.767Z"]},"sort":[1626860810767]}`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 19, 2021, 6:26am UTC](https://discuss.elastic.co/t/email-alert-body-readable-format/279344/2 "2021-08-19T06:26:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.