It's easier to assist you if you don't open multiple topics on the same question. Let's continue the discussion in your existing topic How to get report of before and after 5 lines of log when message match = my-error to my email in x-pack in elasticsearch in plain text format