# Output email don´t add % fields

**URL:** https://discuss.elastic.co/t/output-email-don-t-add-fields/239421
**Category:** Logstash
**Created:** [July 1, 2020, 7:11am UTC](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421 "2020-07-01T07:11:28Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Txurrispo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/txurrispo/32/71430_2.png) [@Txurrispo](https://discuss.elastic.co/u/Txurrispo)
#### Post date: [July 1, 2020, 7:11am UTC](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421/1 "2020-07-01T07:11:29Z")

</div>

Hi all.

I´m using a basic ELK stack to pharse windows DC event logs (winbeats) and send email (sendmail) to our Ticket system. When user is created, blocked, changed password etc....

All works.  
But i see in the documentation, that i can put (for example) in the subjet a field of logstash that include the username or the message complete. Using % before the name of the field.

Example

Mi elasticsearch have this value:

winlog.event\_data.TargetUserName = johndoe  
message = An attempt was made to reset an account's password. Subject:......

My logstash (that works is this)

```
  beats{
        port => "5044"
  }
}

output{
  elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "%{[@metadata][beat]}-%{+YYYY-MM-dd}"
  }
	    if [event][code] == 4724 {
        email {
        from => "email@domain.com"
        to => "email2@domain.com"
        subject => "ALERT Reset Password from a Privileged Admin, User %{winlog.event_data.TargetUserName}"
        body => "Message is: \n'%{message}'. \n"
        via => "sendmail"
                        }
                }

}

```

But %{message} and %{winlog.event\_data.TargetUserName} apperas as is . not with the data jondhoe or the complet message.

Could you help me?  
Thanks  
Regards.

---

<div class="post-metadata">

### Author: ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)
#### Post date: [July 1, 2020, 7:30am UTC](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421/2 "2020-07-01T07:30:19Z")

</div>

Hi,

I think if you use the single quotes in the body then it will be seen as a string.  
` body => "Message is: \n %{message}. \n"`

and nested fields need to be used like this:  
`%{[winlog][event_data][TargetUserName]}`

I hope this helps

---

<div class="post-metadata">

### Author: ![Txurrispo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/txurrispo/32/71430_2.png) [@Txurrispo](https://discuss.elastic.co/u/Txurrispo)
#### Post date: [July 1, 2020, 8:28am UTC](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421/3 "2020-07-01T08:28:42Z")

</div>

Works booth!!!!

Thank You!!!!!!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 29, 2020, 8:28am UTC](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421/4 "2020-07-29T08:28:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.