How to create a watch that email specific field from input index?

Thanks Alex for promt response.
My index has fields like beat.hostname, syslog_message and some more
how I can include only these two fields?