# How to show fild's contain throught connector log

**URL:** <https://discuss.elastic.co/t/how-to-show-filds-contain-throught-connector-log/379125>\
**Category:** Kibana\
**Tags:** elastic-stack-security, elastic-stack-alerting, painless\
**Created:** [June 12, 2025, 8:28am UTC](https://discuss.elastic.co/t/how-to-show-filds-contain-throught-connector-log/379125 "2025-06-12T08:28:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dariia\_Hrebenichenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dariia_hrebenichenko/32/139651_2.png) [@Dariia\_Hrebenichenko](https://discuss.elastic.co/u/Dariia_Hrebenichenko)\
**Post date:** [June 12, 2025, 8:28am UTC](https://discuss.elastic.co/t/how-to-show-filds-contain-throught-connector-log/379125/1 "2025-06-12T08:28:28Z")

</div>

Hello there!

I'm working on an alerting system.  
I use Kibana connector log and Logstash to sand emails.

For now I have rule to show just a count of files, but I would like to see the contain of field.

For example, I have fields 'state' and 'filename'. My rule has filter by 'state' field when it is with 'error'. But it shows only the count ( like 5 errors for last 10 minutes).  
I want to see contain of 'filename' field (when it is in error state).

Is there some options in Kibana to do that?

Thank you for any answers!

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [June 12, 2025, 9:59am UTC](https://discuss.elastic.co/t/how-to-show-filds-contain-throught-connector-log/379125/2 "2025-06-12T09:59:33Z")

</div>

Hello @Dariia_Hrebenichenko

Welcome to the community.

This will return all the values of filename as per the records which qualify your rule

```auto
{
  "filename": "{{#context.hits}} {{_source.filename}} {{/context.hits}}"
}

```

If you just want to display the first value :

```auto

{
  "filename": "{{context.hits.0._source.filename}}"
}

```

Thanks!!

---

<div class="post-metadata">

**Author:** ![Dariia\_Hrebenichenko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dariia_hrebenichenko/32/139651_2.png) [@Dariia\_Hrebenichenko](https://discuss.elastic.co/u/Dariia_Hrebenichenko)\
**Post date:** [June 12, 2025, 1:27pm UTC](https://discuss.elastic.co/t/how-to-show-filds-contain-throught-connector-log/379125/3 "2025-06-12T13:27:50Z")

</div>

Yes, thank you!

Also needed to use a good type of rule for that.