Hi there, I have set up an advanced Watch and it triggers upon 3 or more of the same TargetUserName with the EventID:4625, basically that alerts on any user failing to logon 3 times in 3 minutes. Here is my body section of the email callback: "body": { "text": "The user: {{ctx.payload.Ta…

Include Fields in Watcher Email Alert

MultiplierMultiplier (G T) January 16, 2018, 4:11pm 7

How would I go about including TargetUserName.keyword?

Cheers,

Watcher payload json array access

Topic		Replies	Views
Alerting Conditions and Email Body Elasticsearch elastic-stack-alerting	9	2416	February 12, 2018
Include Fields in Watcher Email Alert Elasticsearch elastic-stack-alerting , painless	4	335	August 17, 2022
Help with Advanced Watcher Elasticsearch elastic-stack-alerting	3	406	December 30, 2019
More Than one Aggregate in Watcher? Elasticsearch elastic-stack-alerting	2	1633	February 14, 2018
Need help with watcher to send the correct fields of result in the email Elasticsearch elastic-stack-alerting	6	1287	June 23, 2020