# How to add the "hostname" and "environment" variables in the "message body" of the email alert sent from Watcher in Kibana?

**URL:** https://discuss.elastic.co/t/how-to-add-the-hostname-and-environment-variables-in-the-message-body-of-the-email-alert-sent-from-watcher-in-kibana/323476
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [January 19, 2023, 6:24am UTC](https://discuss.elastic.co/t/how-to-add-the-hostname-and-environment-variables-in-the-message-body-of-the-email-alert-sent-from-watcher-in-kibana/323476 "2023-01-19T06:24:20Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Shiva\_Subramaniyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shiva_subramaniyan/32/81251_2.png) [@Shiva\_Subramaniyan](https://discuss.elastic.co/u/Shiva_Subramaniyan)
#### Post date: [January 19, 2023, 6:24am UTC](https://discuss.elastic.co/t/how-to-add-the-hostname-and-environment-variables-in-the-message-body-of-the-email-alert-sent-from-watcher-in-kibana/323476/1 "2023-01-19T06:24:20Z")

</div>

Hi,

We had created Watcher and configured alert rules to send the email when a threshold is breached.

The email body should contain the "hostname" and the corresponding "environment" when it is triggered.

We tried to use {{context.hostname}} as well as {\_source.hostname} in the message body of the alert while configuring the rule and either of them did not work.

Can someone let us know how to get these variables into the message body of the alert while configuring it in Kibana?

---

<div class="post-metadata">

### Author: ![Shiva\_Subramaniyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shiva_subramaniyan/32/81251_2.png) [@Shiva\_Subramaniyan](https://discuss.elastic.co/u/Shiva_Subramaniyan)
#### Post date: [January 19, 2023, 6:54am UTC](https://discuss.elastic.co/t/how-to-add-the-hostname-and-environment-variables-in-the-message-body-of-the-email-alert-sent-from-watcher-in-kibana/323476/2 "2023-01-19T06:54:44Z")

</div>

We have the following fields in our index to get the hostname and environment variables:

1. fields.app.env
2. host.hostname
3. agent.hostname

We have configured the alert based on the "message content" received in one of the "index" and we have these fields in this index. We need to get the appropriate "hostname" and "environment" in the email when a alert is triggered from this "index". Please send in your suggestions.

---

<div class="post-metadata">

### Author: ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [January 19, 2023, 5:29pm UTC](https://discuss.elastic.co/t/how-to-add-the-hostname-and-environment-variables-in-the-message-body-of-the-email-alert-sent-from-watcher-in-kibana/323476/3 "2023-01-19T17:29:46Z")

</div>

Watcher has a different "[context](https://www.elastic.co/guide/en/elasticsearch/reference/current/how-watcher-works.html#watch-execution-context)" than Kibana Alerts' [context](https://www.elastic.co/guide/en/kibana/master/create-and-manage-rules.html#defining-rules-actions-variable-context).

If you want to see examples of pulling variable values in a Watch, look at some of the examples: [examples/Alerting/Sample Watches at master · elastic/examples · GitHub](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches)

---

<div class="post-metadata">

### Author: ![Shiva\_Subramaniyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shiva_subramaniyan/32/81251_2.png) [@Shiva\_Subramaniyan](https://discuss.elastic.co/u/Shiva_Subramaniyan)
#### Post date: [January 23, 2023, 4:53pm UTC](https://discuss.elastic.co/t/how-to-add-the-hostname-and-environment-variables-in-the-message-body-of-the-email-alert-sent-from-watcher-in-kibana/323476/4 "2023-01-23T16:53:12Z")

</div>

Hi,

When we use the following for "hostname" and the "environment" we are getting multiple values based on the number of "hits" and we want to get the UNIQUE "hostname" and "environment" values in our email alerts in Kibana

{{#context.hits}}  
Hostname: {{\_source.host.name}}  
{{/context.hits}}

{{#context.hits}}  
Environment: {{\_source.fields.app.env}}  
{{/context.hits}}

Can someone guide us in this regard?

---

<div class="post-metadata">

### Author: ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [January 25, 2023, 11:03pm UTC](https://discuss.elastic.co/t/how-to-add-the-hostname-and-environment-variables-in-the-message-body-of-the-email-alert-sent-from-watcher-in-kibana/323476/5 "2023-01-25T23:03:25Z")

</div>

Ok...seems like you're using Kibana Alerts and not Watcher after all.

But, what flavor of Kibana Alert Rule are you using? As for as I know, only the "[Elasticsearch query](https://www.elastic.co/guide/en/kibana/master/rule-type-es-query.html)" rule type will produce `hits` so that you can iterate through them using the {{#context.hits}}  
syntax referenced.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 22, 2023, 11:04pm UTC](https://discuss.elastic.co/t/how-to-add-the-hostname-and-environment-variables-in-the-message-body-of-the-email-alert-sent-from-watcher-in-kibana/323476/6 "2023-02-22T23:04:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
