# How to get report of before and after +/-5 lines of log when message match = my-error to my email in x-pack in elasticsearch

**URL:** <https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch/163149>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 7, 2019, 6:40am UTC](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch/163149 "2019-01-07T06:40:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![balamelangi](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@balamelangi](https://discuss.elastic.co/u/balamelangi)\
**Post date:** [January 7, 2019, 6:40am UTC](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch/163149/1 "2019-01-07T06:40:33Z")

</div>

PUT \_xpack/watcher/watch/log\_error\_watch  
{  
"trigger" : { "schedule" : { "interval" : "10s" }},  
"input" : {  
"search" : {  
"request" : {  
"indices" : ["filebeat-\*"],  
"body" : {  
"query" : {  
"bool" : {  
"must" : [  
{ "match" : { "message": "error" }},  
{ "range" : { "result.execution\_time" : { "from" : "now-10s" }}}  
]  
}  
}  
}  
}  
}  
},  
"condition" : {  
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}  
},  
"actions" : {  
"email\_admin" : {  
"email": {  
"to": "John Doe [john.doe@example.com](mailto:john.doe@example.com)",  
"subject" : "Error Warning from Watcher",  
"body": "{{ctx.payload.hits.total}} errors JBOSS Error Logs. They are {{ctx.payload.hits.hits.0.\_source.host}} {{ctx.payload.hits.hits.0.\_source.message}} {{ctx.payload.hits.hits.1.\_source.message}} {{ctx.payload.hits.hits.2.\_source.message}} "

}  
}  
}

Here I want to get before and after +/-5 lines and host.name only when the message matches error in email using x-pack in elasticsearch in the form of plain text format. Please, anyone, help me here.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 7, 2019, 7:03am UTC](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch/163149/2 "2019-01-07T07:03:56Z")

</div>

It's easier to assist you if you don't open multiple topics on the same question. Let's continue the discussion in your existing topic [How to get report of before and after 5 lines of log when message match = my-error to my email in x-pack in elasticsearch in plain text format](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch-in-plain-text-format/162572)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 7, 2019, 7:04am UTC](https://discuss.elastic.co/t/how-to-get-report-of-before-and-after-5-lines-of-log-when-message-match-my-error-to-my-email-in-x-pack-in-elasticsearch/163149/3 "2019-01-07T07:04:10Z")

</div>