# Need help on elastic search

**URL:** <https://discuss.elastic.co/t/need-help-on-elastic-search/49372>\
**Category:** Elastic Community and Ecosystem\
**Created:** [May 6, 2016, 5:59am UTC](https://discuss.elastic.co/t/need-help-on-elastic-search/49372 "2016-05-06T05:59:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![vmankala](https://avatars.discourse-cdn.com/v4/letter/v/96bed5/32.png) [@vmankala](https://discuss.elastic.co/u/vmankala)\
**Post date:** [May 6, 2016, 5:59am UTC](https://discuss.elastic.co/t/need-help-on-elastic-search/49372/1 "2016-05-06T05:59:28Z")

</div>

I have setup ELK environment. Installed filebeat on few servers and installed logstash on separate single server -10-192-4-253. I have setup Elastalert configuration in logstash server. Below is "/example\_frequency.yaml" at "/opt/logstash/python/elastalert" location

type: frequency  
index: logstash-\*  
num\_events: 50  
timeframe:  
hours: 4  
filter:

- term:  
type: "stdout"  
alert:
- "email"  
alert\_text: |  
"ElastAlert has detected suspicious activity for {0} \< b\>ElastAlert has detected suspicious activity for {0}\< /b\>"  
At {1}, an {2} error occured. Do something about it!

alert\_text\_args:

- email
- host
- type  
email:

In the alert mail I am also getting the json code as follow

"ElastAlert has detected suspicious activity for \< b\>ElastAlert has detected suspicious activity for \< /b\>"  
At ip-10-169-1-48.ec2.internal, an stdout error occured. Do something about it!

At least 50 events occurred between 2016-05-05 03:36 EDT and 2016-05-05 07:36 EDT

(following is json code)  
@timestamp: 2016-05-05T11:36:32.022Z  
@version: 1  
id: AVSAtIJ5Ydfq7dPgGSL  
\_index: logstash-2016.05.05  
\_type: stdout  
beat: {  
"hostname": "ip-10-169-1-48.ec2.internal",  
"name": "ip-10-169-1-48.ec2.internal"  
}  
count: 1  
fields: {  
"environment": "NA-DEV",  
"platform": "RSDMT"  
}  
host: ip-10-169-1-48.ec2.internal  
input\_type: log  
message: 07:36:29,391 |-INFO in ch.qos.logback.core.joran.action.AppenderAction - About to instantiate appender of type [ch.qos.logback.core.rolling.RollingFileAppender]  
offset: 510957  
source: /opt/tomcat/logs/stdout.log  
tags: [  
"beats\_input\_codec\_plain\_applied"  
]  
type: stdout

How do I need to omit above json code from alert mail. Please suggest.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 6, 2016, 6:00am UTC](https://discuss.elastic.co/t/need-help-on-elastic-search/49372/2 "2016-05-06T06:00:09Z")

</div>

Please do not cross post - [Need help on Elastalert](https://discuss.elastic.co/t/need-help-on-elastalert/49295)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 6, 2016, 6:00am UTC](https://discuss.elastic.co/t/need-help-on-elastic-search/49372/3 "2016-05-06T06:00:12Z")

</div>