# Fields include in watcher not working properly. (Email Alert)
**URL:** https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [December 6, 2019, 7:57am UTC](https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841 "2019-12-06T07:57:18Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)
#### Post date: [December 6, 2019, 7:57am UTC](https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841/1 "2019-12-06T07:57:18Z")
Hi,
I have set up of ELK 7.4.2 on a linux server. There I am receiving a palto alto logs and I want to trigger alert for any drop or deny event. I am able to fire alert for this. But when I am specifying the filed name in subject it is returning empty filed. Value is not there.
Below is the entire watcher:
> ```
> {
> "trigger": {
> "schedule": {
> "interval": "1m"
> }
> },
> "input": {
> "search": {
> "request": {
> "search_type": "query_then_fetch",
> "indices": [
> "filebeat-*"
> ],
> "rest_total_hits_as_int": true,
> "body": {
> "size": 0,
> "query": {
> "bool": {
> "must": [
> {
> "match_phrase": {
> "cef.device.vendor": {
> "query": "Palo Alto Networks"
> }
> }
> },
> {
> "term": {
> "event.action": {
> "value": "deny"
> }
> }
> },
> {
> "exists": {
> "field": "event.action"
> }
> }
> ],
> "filter": {
> "range": {
> "@timestamp": {
> "gte": "now-15m"
> }
> }
> }
> }
> }
> }
> }
> }
> },
> "condition": {
> "compare": {
> "ctx.payload.hits.total": {
> "gte": 0
> }
> }
> },
> "actions": {
> "send_email": {
> "email": {
> "profile": "standard",
> "to": [
> "xyz@companyname.com"
> ],
> "subject": "Alert : There is deny and drop req in the url",
> "body": {
> "text": "Timestamp:{{#ctx.payload.hits.hits}} {{_source.@timestamp}} {{/ctx.payload.hits.hits}}/n Action {{#ctx.payload.hits.hits}} {{_source.event.action}} {{/ctx.payload.hits.hits}}/n "
> }
> }
> }
> }
> }
>
> ```
I am supposed to get the output something like this:
Timsestamp: 06-Dec-2019 12:01:54
Action: deny
But I am not getting the value it is empty.
And here is the output of execute watch API.
> {
> "watch\_id": "8a0c0876-d546-4ffb-877d-7123957cc7c0",
> "node": "Amf8D-gtTsGr0\_Bv-ewuTQ",
> "state": "executed",
> "user": "elastic",
> "status": {
> "state": {
> "active": true,
> "timestamp": "2019-12-06T07:35:16.737Z"
> },
> "last\_checked": "2019-12-06T07:36:16.856Z",
> "last\_met\_condition": "2019-12-06T07:36:16.856Z",
> "actions": {
> "send\_email": {
> "ack": {
> "timestamp": "2019-12-06T07:36:16.856Z",
> "state": "ackable"
> },
> "last\_execution": {
> "timestamp": "2019-12-06T07:36:16.856Z",
> "successful": true
> },
> "last\_successful\_execution": {
> "timestamp": "2019-12-06T07:36:16.856Z",
> "successful": true
> }
> }
> },
> "execution\_state": "executed",
> "version": -1
> },
> "trigger\_event": {
> "type": "schedule",
> "triggered\_time": "2019-12-06T07:36:16.856Z",
> "schedule": {
> "scheduled\_time": "2019-12-06T07:36:16.774Z"
> }
> },
> "input": {
> "search": {
> "request": {
> "search\_type": "query\_then\_fetch",
> "indices": [
> "filebeat-_"
> ],
> "rest\_total\_hits\_as\_int": true,
> "body": {
> "size": 0,
> "query": {
> "bool": {
> "must": [
> {
> "match\_phrase": {
> "cef.device.vendor": {
> "query": "Palo Alto Networks"
> }
> }
> },
> {
> "term": {
> "event.action": {
> "value": "deny"
> }
> }
> },
> {
> "exists": {
> "field": "event.action"
> }
> }
> ],
> "filter": {
> "range": {
> "@timestamp": {
> "gte": "now-15m"
> }
> }
> }
> }
> }
> }
> }
> }
> },
> "condition": {
> "compare": {
> "ctx.payload.hits.total": {
> "gte": 0
> }
> }
> },
> "metadata": {
> "name": "try",
> "xpack": {
> "type": "json"
> }
> },
> "result": {
> "execution\_time": "2019-12-06T07:36:16.856Z",
> "execution\_duration": 227,
> "input": {
> "type": "search",
> "status": "success",
> "payload": {
> "\_shards": {
> "total": 2,
> "failed": 0,
> "successful": 2,
> "skipped": 0
> },
> "hits": {
> "hits": [\*],
> "total": 10000,
> "max\_score": null
> },
> "took": 8,
> "timed\_out": false
> },
> "search": {
> "request": {
> "search\_type": "query\_then\_fetch",
> "indices": [
> "filebeat-_"
> ],
> "rest\_total\_hits\_as\_int": true,
> "body": {
> "size": 0,
> "query": {
> "bool": {
> "must": [
> {
> "match\_phrase": {
> "cef.device.vendor": {
> "query": "Palo Alto Networks"
> }
> }
> },
> {
> "term": {
> "event.action": {
> "value": "deny"
> }
> }
> },
> {
> "exists": {
> "field": "event.action"
> }
> }
> ],
> "filter": {
> "range": {
> "@timestamp": {
> "gte": "now-15m"
> }
> }
> }
> }
> }
> }
> }
> }
> },
> "condition": {
> "type": "compare",
> "status": "success",
> "met": true,
> "compare": {
> "resolved\_values": {
> "ctx.payload.hits.total": 10000
> }
> }
> },
> "actions": [
> {
> "id": "send\_email",
> "type": "email",
> "status": "success",
> "email": {
> "account": "outlook\_account",
> "message": {
> "id": "send\_email\_8a0c0876-d546-4ffb-877d-7123957cc7c0\_623d1122-8072-4317-80ae-7e417f7556e9-2019-12-06T07:36:16.856681Z",
> "from": "no-reply@siem.local",
> "sent\_date": "2019-12-06T07:36:16.907059Z",
> "to": [
> "[xyz@companyname.com](mailto:xyz@companyname.com)"
> ],
> "subject": "Alert : There is deny and drop req in the url",
> "body": {
> "text": "Timestamp:/n Action /n "
> }
> }
> }
> }
> ]
> },
> "messages":
> }
If anything more requires please tell I'll post it.
Kindly help
Thanks,
Tahseen
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [December 6, 2019, 12:06pm UTC](https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841/2 "2019-12-06T12:06:41Z")
Hey,
you are using `"size": 0` in your query, which basically omits any results.
--Alex
---
### Author:  [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)
#### Post date: [December 6, 2019, 12:12pm UTC](https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841/3 "2019-12-06T12:12:55Z")
So should I have to make it 1.
Just let me try.
---
### Author:  [@tahseen\_fatima](https://discuss.elastic.co/u/tahseen_fatima)
#### Post date: [December 9, 2019, 11:19am UTC](https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841/4 "2019-12-09T11:19:55Z")
It worked!!!
Thanks
Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 6, 2020, 11:20am UTC](https://discuss.elastic.co/t/fields-include-in-watcher-not-working-properly-email-alert/210841/5 "2020-01-06T11:20:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.