Extraction query for monitor

[Rashmita_Shetty (rdshetty)]

Hello, I have recently built a few alerts in Kibana (7.1.1). The alerts that I have using the extraction method is to query a specific value in the field : CustomerEndpoint address.
I am trying to understand, if I had to add 2 values in the Endpoint address, how will I do so?
Should I be using array/ OR operator?
<
{
"match_phrase": {
"CustomerEndpoint.Address": {
"query": "xxxxx12345",
"slop": 0,
"zero_terms_query": "NONE",
"boost": 1
}
}
}
]

2. Under the action items in trigger > there is a box for message preview , how can I add the some fields from _source in that message?

[weltenwort (Felix Stürmer)]

Hi @Rashmita_Shetty,

regarding your first question, you could either use a query_string query and spell out the OR or formulate two match_phrase queries and wrap them in a bool query's should clause.

As for the message trigger, it should support templating to allow for the inclusion of values from the triggering documents.