# Output pretty formatted json of all event fields in mail

**URL:** <https://discuss.elastic.co/t/output-pretty-formatted-json-of-all-event-fields-in-mail/51161>\
**Category:** Logstash\
**Created:** [May 27, 2016, 1:33pm UTC](https://discuss.elastic.co/t/output-pretty-formatted-json-of-all-event-fields-in-mail/51161 "2016-05-27T13:33:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MartinMystikJonas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/martinmystikjonas/32/9996_2.png) [@MartinMystikJonas](https://discuss.elastic.co/u/MartinMystikJonas)\
**Post date:** [May 27, 2016, 1:33pm UTC](https://discuss.elastic.co/t/output-pretty-formatted-json-of-all-event-fields-in-mail/51161/1 "2016-05-27T13:33:52Z")

</div>

I'm want to send alert e-mails for certain log events and I want to print all event fields in e-mail body.

Bud I did not found way how to output them in pretty formatted json.

Currently i use this:

```
 filter {
   if "email" in [tags] {
     ruby {
       init => "require 'json'"
       code => "event['@metadata']['json'] = JSON.pretty_generate(event)"
     }
   }
}
output {
  if "email" in [tags] {
    email {
      to => "sysadmin@growjob.com"
      subject => "[%{host}] Log %{type} alert"
      body => "%{[@metadata][json]}"
    }
  }
}

```

But even when i use pretty\_generate output still looks like this:

{"message":"127.0.0.1 - - [27/May/2016:15:26:42 +0200] "GET /ccc HTTP/1.1" 404 162 "-" "curl/7.38.0" "localhost"","@version":"1","@timestamp":"2016-05-27T13:26:42.000Z","path":"/var/log/nginx/access.log","host":"test-router","type":"nginx-access","@original\_message":"127.0.0.1 - - [27/May/2016:15:26:42 +0200] "GET /ccc HTTP/1.1" 404 162 "-" "curl/7.38.0" "localhost"","clientip":"127.0.0.1","ident":"-","auth":"-","verb":"GET","request":"/ccc","httpversion":"1.1","response":404,"bytes":162,"referrer":"-","agent":""curl/7.38.0"","http\_host":"localhost","name":"Other","os":"Other","os\_name":"Other","device":"Other","url":"localhost/ccc","description":"Returned 500 from localhost/ccc","tags":["email"]}

---

<div class="post-metadata">

**Author:** ![dm0000](https://avatars.discourse-cdn.com/v4/letter/d/f475e1/32.png) [@dm0000](https://discuss.elastic.co/u/dm0000)\
**Post date:** [July 27, 2016, 9:42pm UTC](https://discuss.elastic.co/t/output-pretty-formatted-json-of-all-event-fields-in-mail/51161/2 "2016-07-27T21:42:59Z")

</div>

Have you tried wrapping them in `<pre></pre>` tags?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:46am UTC](https://discuss.elastic.co/t/output-pretty-formatted-json-of-all-event-fields-in-mail/51161/3 "2017-07-06T04:46:11Z")

</div>

Closed on July 6, 2017, 4:46am UTC