# How to enable Kibana to get the fields from an ES object (esp. elastalert)

**URL:** https://discuss.elastic.co/t/how-to-enable-kibana-to-get-the-fields-from-an-es-object-esp-elastalert/84044
**Category:** Kibana
**Created:** [April 28, 2017, 6:19pm UTC](https://discuss.elastic.co/t/how-to-enable-kibana-to-get-the-fields-from-an-es-object-esp-elastalert/84044 "2017-04-28T18:19:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![mr\_chang7](https://avatars.discourse-cdn.com/v4/letter/m/cc9497/32.png) [@mr\_chang7](https://discuss.elastic.co/u/mr_chang7)
#### Post date: [April 28, 2017, 6:19pm UTC](https://discuss.elastic.co/t/how-to-enable-kibana-to-get-the-fields-from-an-es-object-esp-elastalert/84044/1 "2017-04-28T18:19:11Z")

</div>

The following is some of the fields from the elastalert; but learned that the match\_body is an object that cannot be recognized/used on kibana. (Kibana index refresh does not get the ? marks away)

* * *

## t \_index elastalert\_status t \_type elastalert t alert\_info.command echo Alert Raised: cpu \> 70 t alert\_info.type command alert\_sent true alert\_time April 17th 2017, 12:42:17.534 ? match\_body.@timestamp 2017-04-17T16:42:16.533541Z ? match\_body.cpu\_max 81 ? match\_body.num\_hits 32 ? match\_body.num\_matches 1

But still I'm wondering any approach (from a simple to a bit complicated) could enable me to use the fields.

Thanks guys.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 26, 2017, 6:27pm UTC](https://discuss.elastic.co/t/how-to-enable-kibana-to-get-the-fields-from-an-es-object-esp-elastalert/84044/2 "2017-05-26T18:27:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.