# How to include the hostname and location of the log within Watcher alerts?
**URL:** https://discuss.elastic.co/t/how-to-include-the-hostname-and-location-of-the-log-within-watcher-alerts/71539
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [January 13, 2017, 3:51pm UTC](https://discuss.elastic.co/t/how-to-include-the-hostname-and-location-of-the-log-within-watcher-alerts/71539 "2017-01-13T15:51:46Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@elkuser](https://discuss.elastic.co/u/elkuser)
#### Post date: [January 13, 2017, 3:51pm UTC](https://discuss.elastic.co/t/how-to-include-the-hostname-and-location-of-the-log-within-watcher-alerts/71539/1 "2017-01-13T15:51:46Z")
Hi,
I have a working watcher alert which I would like to update and include the hostname and path info within the same message - but I can't seem to get the correct syntax!!
## Currently, I have the following working:
"body": {
```
"html": "There were {{ctx.payload.hits.total}} matches of \"some error string\" within the last N minutes at {{ctx.execution_time}}.
Here is an example message found:
{{ctx.payload.hits.hits.0._source.message}}
."
```
## }
Supposing, if {{host}} and {{path}} would work, I'd like the above message to read as: "There were {{ctx.payload.hits.total}} matches of "some error string" within the last N minutes on {{host}} at {{ctx.execution\_time}}.
Here is an example message found:
{{ctx.payload.hits.hits.0.\_source.message}}
Please check the {{path}}."
Can someone please suggest how it can be done? Thanks in advance!
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 14, 2017, 10:50pm UTC](https://discuss.elastic.co/t/how-to-include-the-hostname-and-location-of-the-log-within-watcher-alerts/71539/2 "2017-01-14T22:50:20Z")
Hey,
I am sorry, but I was not able to extract your exact question from the post. Can you please include a sample document of your search and what you would like to extract from that? If it is just about extracting a field, you already used `ctx.payload.hits.hits.0._source.message` to access a field in the `body`. If you want to extract the hostname and the path from this field, you have to do that before indexing and not during watch execution.
--Alex
---
### Author:  [@elkuser](https://discuss.elastic.co/u/elkuser)
#### Post date: [January 19, 2017, 10:22pm UTC](https://discuss.elastic.co/t/how-to-include-the-hostname-and-location-of-the-log-within-watcher-alerts/71539/3 "2017-01-19T22:22:24Z")
Hi Alex,
thank you for the tip - I was able to retrieve the hostname and path info in the same way as the message, using ctx.payload.hits.hits.0.\_source.host and ctx.payload.hits.hits.0.\_source.path, which were already defined.
~elkuser
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2017, 10:22pm UTC](https://discuss.elastic.co/t/how-to-include-the-hostname-and-location-of-the-log-within-watcher-alerts/71539/4 "2017-02-16T22:22:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.