# Help with rule variables(email alert) **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-alerting\ **Created:** [September 3, 2021, 6:52pm UTC](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313 "2021-09-03T18:52:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Dovan](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Dovan](https://discuss.elastic.co/u/Dovan)\ **Post date:** [September 3, 2021, 6:52pm UTC](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313/1 "2021-09-03T18:52:06Z")
I would like to know if it is possible for me to use the value of an event field in the email notification of a rule, for example, in the log index comes the fields with IP, SRC, ATTACK\_INFO, severity and others, and I would like to put these fields in the body of the notification via email (of the event that generated the alert). Would it be possible to do something like {{SRC}} and put it in the body of the email, and in the alert it brings the value of this field? ---
**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\ **Post date:** [September 3, 2021, 11:28pm UTC](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313/2 "2021-09-03T23:28:37Z")
Hello, Can you please look at this doc? [Create and manage rules | Kibana Guide [7.x] | Elastic](https://www.elastic.co/guide/en/kibana/7.x/create-and-manage-rules.html) From what I see - this looks possible? Thanks, Bhavya ---
**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\ **Post date:** [September 7, 2021, 12:42pm UTC](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313/3 "2021-09-07T12:42:28Z")
Each rule type exposes a set of variables prefixed with `context.` for use in actions like email. Which rule type are you using? Under this section of the documentation, you can see the variables that are available in a popup window displayed when clicking the blue button next to an action field - [Create and manage rules | Kibana Guide [7.x] | Elastic](https://www.elastic.co/guide/en/kibana/7.x/create-and-manage-rules.html#defining-rules-actions-variables) ---
**Author:** ![Dovan](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Dovan](https://discuss.elastic.co/u/Dovan)\ **Post date:** [September 8, 2021, 1:49pm UTC](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313/4 "2021-09-08T13:49:19Z")
okay thanks!, I'll take a look at the documentation. I have one more question about alerts (email connector), can I use HTML on it? ---
**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\ **Post date:** [September 8, 2021, 9:03pm UTC](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313/5 "2021-09-08T21:03:22Z")
The email connector expects the `message` parameter to be in markdown format, and will then convert that to HTML after expanding the mustache templates. The email is then sent multi-part, with the generated HTML as text/html, and the markdown after expanding the mustache templates as text/plain. It should render as HTML in email clients that support HTML. The markdown processor is configured to NOT accept inline html, for security reasons. more info here: [Email connector and action | Kibana Guide [7.14] | Elastic](https://www.elastic.co/guide/en/kibana/current/email-action-type.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 6, 2021, 9:04pm UTC](https://discuss.elastic.co/t/help-with-rule-variables-email-alert/283313/6 "2021-10-06T21:04:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.