# Log Threshold - Alert Body

**URL:** <https://discuss.elastic.co/t/log-threshold-alert-body/350979>\
**Category:** Logs\
**Tags:** elastic-stack-alerting\
**Created:** [January 12, 2024, 4:15pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979 "2024-01-12T16:15:43Z")\
**Posts on this page:** 14\
**Page:** 2

<div class="post-metadata">

**Author:** ![NShrek](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@NShrek](https://discuss.elastic.co/u/NShrek)\
**Post date:** [February 6, 2024, 4:07pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/21 "2024-02-06T16:07:36Z")

</div>

@erikg I did the same . But my details are coming as the row .

pls see below.  
If i move all my headings such as Destination IP address and Destination APP, all data messed up.

```auto
|||
|--------------| ------------|
| **Blocked Traffic Information** | - |
{{#context.hits}}
|- **Destination IP Address** | {{_source.v2.private.dst_ip}}
| **Destination Application Name** |{{_source.v2.private.dst_labels.app}}
| **Destination Port** | {{_source.v2.private.dst_port}}
| **Destination Protocol** | {{_source.v2.private.proto}}
{{/context.hits}}

```

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [February 6, 2024, 6:49pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/22 "2024-02-06T18:49:30Z")

</div>

Ah, I think actually you need to include your heading AFTER {{#context.hits}}

| | |
| --- | --- |
| {{#context.hits}} | |
| **Blocked Traffic Information** | - |
| - **Destination IP Address** | {{\_source.v2.private.dst\_ip}} |
| **Destination Application Name** | {{\_source.v2.private.dst\_labels.app}} |
| **Destination Port** | {{\_source.v2.private.dst\_port}} |
| **Destination Protocol** | {{\_source.v2.private.proto}} |
| {{/context.hits}} | |

I think this what you were trying to do^?

---

<div class="post-metadata">

**Author:** ![NShrek](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@NShrek](https://discuss.elastic.co/u/NShrek)\
**Post date:** [February 6, 2024, 7:09pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/23 "2024-02-06T19:09:42Z")

</div>

@erikg Hey,

I need the presentation be vertical .

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/2131c4bf0aa10a0737b90d4380c4a7ff07046f26.png)  
I want to show data in simple table format with column as like as screenshot.

If you see the screenshot from 1 day ago , everything in email is coming as row.

Best,  
Narges

---

<div class="post-metadata">

**Author:** ![NShrek](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@NShrek](https://discuss.elastic.co/u/NShrek)\
**Post date:** [February 6, 2024, 7:15pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/24 "2024-02-06T19:15:58Z")

</div>

I m sending the observed data in the e-mail @erikg .  
Every box has the data for on query that matched.  
Could you pls also advise why some are coming as blue? It is the new issue!

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5c06e99f91a8a342a9010681c82c93e66968fec7.png)

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [February 6, 2024, 7:34pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/25 "2024-02-06T19:34:23Z")

</div>

| | | | | |
| --- | --- | --- | --- | --- |
| **Blocked Traffic Information** | | | | |
| **Destination IP Address** | **Destination Application Name** | **Destination Port** | **Destination Protocol** | |
| {{#context.hits}} | | | | |
| {{\_source.v2.private.dst\_ip}} | {{\_source.v2.private.dst\_labels.app}} | {{\_source.v2.private.dst\_port}} | {{\_source.v2.private.proto}} | |
| {{/context.hits}} | | | | |

Like this?  
As for the blue, I have not seen that before.

---

<div class="post-metadata">

**Author:** ![NShrek](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@NShrek](https://discuss.elastic.co/u/NShrek)\
**Post date:** [February 6, 2024, 8:26pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/26 "2024-02-06T20:26:45Z")

</div>

@erikg , Ys like that. And when i added everything just dumped in the email with one simple heading . 😑

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [February 6, 2024, 8:30pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/27 "2024-02-06T20:30:38Z")

</div>

Here's how I did that:

```auto
||||||
|-| -|-|-|-|
| **Blocked Traffic Information** | 
| **Destination IP Address** | **Destination Application Name** | **Destination Port** | **Destination Protocol** |
{{#context.hits}}
{{_source.v2.private.dst_ip}} | {{_source.v2.private.dst_labels.app}} | {{_source.v2.private.dst_port}} | {{_source.v2.private.proto}} |
{{/context.hits}}

```

If this is same markdown you used then it might be a limitation.

Thanks,

---

<div class="post-metadata">

**Author:** ![NShrek](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@NShrek](https://discuss.elastic.co/u/NShrek)\
**Post date:** [February 6, 2024, 8:57pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/28 "2024-02-06T20:57:45Z")

</div>

@erikg WOW! You fixed it. It is so clean and nice. Thanks so much! 🤩 🤩

---

<div class="post-metadata">

**Author:** ![NShrek](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@NShrek](https://discuss.elastic.co/u/NShrek)\
**Post date:** [February 6, 2024, 8:58pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/29 "2024-02-06T20:58:57Z")

</div>

@erikg can you please explain the logic so I can learn?

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [February 6, 2024, 10:35pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/30 "2024-02-06T22:35:57Z")

</div>

Hey, sorry I barely understand the logic but I learned you can two methods to do markdown:

Method 1:

| Syntax | Description |
| --- | --- |
| Header | Title |
| Paragraph | Text |

```auto
| Syntax | Description |
| - | - |
| Header | Title |
| Paragraph | Text |

```

OR

Method 2:

| | |
| --- | --- |
| Syntax | Description |
| Header | Title |
| Paragraph | Text |

```auto
|||
| - | - |
| Syntax | Description |
| Header | Title |
| Paragraph | Text |

```

For both methods, your pipes | are your columns. You can specify how many you want.  
Glad you were able to do it!

---

<div class="post-metadata">

**Author:** ![NShrek](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@NShrek](https://discuss.elastic.co/u/NShrek)\
**Post date:** [February 7, 2024, 6:15pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/31 "2024-02-07T18:15:59Z")

</div>

Thanks @erikg 🙏

---

<div class="post-metadata">

**Author:** ![NShrek](https://avatars.discourse-cdn.com/v4/letter/n/b487fb/32.png) [@NShrek](https://discuss.elastic.co/u/NShrek)\
**Post date:** [February 27, 2024, 6:35pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/32 "2024-02-27T18:35:42Z")

</div>

@erikg , Hello

I could deploy the solution and it works as expected. The only thing that I see there is one extra bullet created in the e-mail notification which I dont know why is that. The person who implemented the body content of e-mail in PROD is using MAC computer and Chrome and just copying from my content . I use windows surface machine.

Do you think this is why we get extra bullet?

that individual is copying my template from pre prod and we see extra bullet which I don't have it in preprod with same body content.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/f/5f61c254be6e73526b4b2a94a38a9f02ea6e7c18.png)

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [February 27, 2024, 7:04pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/33 "2024-02-27T19:04:19Z")

</div>

Hey @NShrek , I actually haven't seen that before. Perhaps share your body content?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2024, 7:05pm UTC](https://discuss.elastic.co/t/log-threshold-alert-body/350979/34 "2024-03-26T19:05:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/log-threshold-alert-body/350979.md?page=1)