# Include Fields in Watcher Email Alert

**URL:** https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/115700
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [January 16, 2018, 11:46am UTC](https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/115700 "2018-01-16T11:46:11Z")
**Posts on this page:** 1
**Showing post:** 18

<div class="post-metadata">

### Author: ![MultiplierMultiplier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/multipliermultiplier/32/25063_2.png) [@MultiplierMultiplier](https://discuss.elastic.co/u/MultiplierMultiplier)
#### Post date: [February 5, 2018, 10:42am UTC](https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/115700/18 "2018-02-05T10:42:27Z")

</div>

Hi @spinscale,

I have had chance to get look into advanced watches again.

I am now getting values returned after looking at your advice.

```
"hits": {
          "hits": [
            {
              "_index": "main",
              "_type": "doc",
              "_source": {
                "process_id": 620,
                "computer_name": "TEST",
                "keywords": [
                  "Audit Failure"
                ],
                "log_name": "Security",
                "level": "Information",
                "record_number": "57628",
                "event_data": {
                  "Status": "0xc000006d",
                  "ProcessName": "-",
                  "LogonType": "3",
                  "IpPort": "0",
                  "SubjectLogonId": "0x0",
                  "TransmittedServices": "-",
                  "KeyLength": "0",
                  "LmPackageName": "-",
                  "SubjectUserName": "-",
                  "FailureReason": "%%2313",
                  "WorkstationName": "TEST",
                  "SubjectDomainName": "-",
                  "IpAddress": "TESTIP",
                  "ProcessId": "0x0",
                  "SubStatus": "0xc000006a",
                  "TargetDomainName": "TEST",
                  "LogonProcessName": "NtLmSsp ",
                  "SubjectUserSid": "S-1-0-0",
                  "TargetUserSid": "S-1-0-0",
                  "AuthenticationPackageName": "NTLM"
                },
                "opcode": "Info",
                "tags": [
                  "beats_input_codec_plain_applied"
                ],
                "thread_id": 496,
                "@timestamp": "2018-02-05T10:33:50.722Z",
                "task": "Logon",
                "event_id": 4625,
                "provider_guid": "{54849625-5478-4994-A5BA-3E3B0328C30D}",
                "activity_id": "{2BF93E71-95E4-0001-8B3E-F92BE495D301}",
                "beat": {
                  "hostname": "TEST",
                  "name": "TEST",
                  "version": "5.6.3"
                },
                "host": "TEST",
                "target_username": "TestUser",
                "source_name": "Microsoft-Windows-Security-Auditing"

```

Above is the output from the watch query, I have set up the email body:

```
    "actions": {
"email_admin": {
  "throttle_period_in_millis": 50000,
  "email": {
    "profile": "standard",
    "to": [
      "george.townson@commissum.com"
    ],
    "subject": "Warning: User Added to Security Enabled Group",
    "body": {
      "text": "A user was added to a security enabled group. {{#ctx.payload.hits.hits}} {{_source.name.target_username}} {{/ctx.payload.hits.hits}}"
    }
  }
}

```

}

Currently I see: "A user was added to a security enabled group. " as the output. How would I get the email callback to return every "target\_username", so I can see which users failed to login?

cheers,

G

---

_[View the full topic](https://discuss.elastic.co/t/include-fields-in-watcher-email-alert/115700)._