# How to add hostname value in email subject or body
**URL:** https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [March 30, 2021, 4:26pm UTC](https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820 "2021-03-30T16:26:55Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@AnamikaN](https://discuss.elastic.co/u/AnamikaN)
#### Post date: [March 30, 2021, 4:26pm UTC](https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820/1 "2021-03-30T16:26:55Z")
Hi,
I would like to add 'hostname' in email subject or body whenever i get 'Failed authentication error' in log messages. I have created an index and it has data for 3 servers. So whenever we see auth error in logs, i would like to send email alert with hostname.
```auto
{
"trigger": {
"schedule": {
"interval": "24h"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"kafka-broker-sac1*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"must": [],
"filter": [
{
"match_all": {}
},
{
"match_phrase": {
"message": {
"query": "Failed authentication with"
}
}
},
{
"range": {
"@timestamp": {
"from": "now-30m",
"to": "now"
}
}
}
],
"should": [],
"must_not": []
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 30
}
}
},
"actions": {
"email_admin": {
"email": {
"profile": "standard",
"attachments": {
"attached_data": {
"data": {
"format": "json"
}
}
},
"to": [
"xxx@xxx.com"
],
"subject": "Failed authentication error recently encountered on kafka-broker-sac1",
"body": {
"text": "{{ctx.payload.hits.total}} Errors have occured in the logs:{{_source.message}}"
}
}
}
}
}
```
Below is one example of log message-
```auto
@timestamp Mar 30, 2021 @ 09:25:33.903
@version 1
_id oR70g3gBr9_-7IbXZO9p
_index kafka-broker-sac1-nonprod-aws-2021.03.30
_score -
_type _doc
agent.ephemeral_id 91a9e58c-3347-4753-b8db-5568ab3d9475
agent.hostname kafka300006
agent.id 2774444d-da99-407a-bedb-8e20fa124a5a
agent.name kafka300006
agent.type filebeat
agent.version 7.9.3
ecs.version 1.5.0
environment.name dev
host.name ed1vebkfk300006
input.type log
log.file.path /var/log/kafka/kafka.log
log.offset 5,929,558
message [2021-03-30 09:25:33,135] INFO [SocketServer brokerId=1001] Failed authentication with /10.216.1.169 (Authentication failed: Invalid username or password) (org.apache.kafka.common.network.Selector)
tags beats_input_codec_plain_applied
top.ingest_latency 1
top.ingest_method beats
top.ingest_time Mar 30, 2021 @ 09:25:35.009
top.message_size 719
```
---
### Author:  [@AClerk](https://discuss.elastic.co/u/AClerk)
#### Post date: [March 30, 2021, 10:21pm UTC](https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820/2 "2021-03-30T22:21:40Z")
A few discussions + examples:
> [@Include Fields in Watcher Email Alert](https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/115700/18):
>
> Hi @spinscale, I have had chance to get look into advanced watches again. I am now getting values returned after looking at your advice. "hits": { "hits": [{ "\_index": "main", "\_type": "doc", "\_source": { "process\_id": 620, "computer\_name": "TEST", "keywords": ["Audit Failure"], "log\_name": "Security", "level": "I…
> [@Watcher - How to reference an index field value in an email body](https://discuss.elastic.co/t/watcher-how-to-reference-an-index-field-value-in-an-email-body/205063):
>
> I would like to trigger a watcher alert using Kibana Watcher UI. The condition works fine but I would like to give additional information in the email body. In my case the watcher will triggered when a transaction duration of 20 seconds has been exceeded. I tried as follows in the body section but it won't work: The following transaction took over 20sec: [{{#ctx.payload.\_value}}{{url.path}}] Could somebody give me a hint how to insert values (in my case: /rest/analytics/receive) …
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 27, 2021, 10:22pm UTC](https://discuss.elastic.co/t/how-to-add-hostname-value-in-email-subject-or-body/268820/3 "2021-04-27T22:22:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.