# How to make the object fields available from elastalert
**URL:** https://discuss.elastic.co/t/how-to-make-the-object-fields-available-from-elastalert/84055
**Category:** Elasticsearch
**Created:** [April 28, 2017, 8:13pm UTC](https://discuss.elastic.co/t/how-to-make-the-object-fields-available-from-elastalert/84055 "2017-04-28T20:13:35Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@mr\_chang7](https://discuss.elastic.co/u/mr_chang7)
#### Post date: [April 28, 2017, 8:13pm UTC](https://discuss.elastic.co/t/how-to-make-the-object-fields-available-from-elastalert/84055/1 "2017-04-28T20:13:35Z")
The following is some of the fields from the elastalert; but learned that the match\_body is an object that cannot be recognized/used on kibana. (Kibana index refresh does not get the ? marks away)
t index elastalertstatus
t \_type elastalert
t alert\_info.command echo Alert Raised: cpu \> 70
t alert\_info.type command
alert\_sent true
alert\_time April 17th 2017, 12:42:17.534
? match\_body.@timestamp 2017-04-17T16:42:16.533541Z
? match\_body.cpu\_max 81
? match\_body.num\_hits 32
? match\_body.num\_matches 1
But still I'm wondering any approach (from a simple to a bit complicated) could enable me to use the fields.
Thanks guys.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 26, 2017, 8:25pm UTC](https://discuss.elastic.co/t/how-to-make-the-object-fields-available-from-elastalert/84055/2 "2017-05-26T20:25:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.