# Pulling relevant info out of logs in watcher alerts
**URL:** https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [December 28, 2018, 6:20pm UTC](https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374 "2018-12-28T18:20:18Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Chris\_Meyer](https://discuss.elastic.co/u/Chris_Meyer)
#### Post date: [December 28, 2018, 6:20pm UTC](https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374/1 "2018-12-28T18:20:19Z")
Hello,
Is there a way to pull information out of logs similar to `{{ctx.payload.hits.total}}`?
Say I am building a report on account lockouts with the goal to send an email if an account gets locked out.
```
"message": "A user account was locked out.
Subject: Security ID: S-1-5-18
Account Name: AD1$
Account Domain: Some domain name
Logon ID: 0x3E7
Account That Was Locked Out:
Security ID: S-1-5-21-2411883017-1342772572-112776168-1167
Account Name: ***THIS USER IS THE FIELD I WANT***
Additional Information:
Caller Computer Name: "No-Malware-Here",
"log_name": "Security",
"event_id": 4740,
"@version": "1",
"source_name": "Microsoft-Windows-Security-Auditing",
"record_number": "3973995",
"thread_id": 4732,
"computer_name": "No-Malware-Here"
```
I want to be able to automate putting a locked user's username in the body of an email action.
Is is _possible_ to be able to use a condition or variable (like {{ctx.payload.hits.total}}) to grab a field such as `"event_id"` or `Account Name:`? I can't seem to find docs on it, but I'm not quite sure what to look for 😛
Thanks!
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [December 28, 2018, 6:48pm UTC](https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374/2 "2018-12-28T18:48:03Z")
`{{ctx.payload.hits.hits.0._source}}` is the map that should contain the source of the first returned document.
---
### Author:  [@Chris\_Meyer](https://discuss.elastic.co/u/Chris_Meyer)
#### Post date: [January 2, 2019, 4:51pm UTC](https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374/4 "2019-01-02T16:51:03Z")
Cool! That worked for me and returns the whole document.
Is there a way I can pull out specific parts of that document to make it more readable in an email?
---
### Author:  [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)
#### Post date: [January 2, 2019, 4:59pm UTC](https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374/5 "2019-01-02T16:59:10Z")
> [@Igor\_Motov](#):
>
> `{{ctx.payload.hits.hits.0._source}}` is the **map** that should contain the source of the first returned document.
Therefore `{{ctx.payload.hits.hits.0._source.specific.part}}` should give you access to `foo` in
`{"specific": {"part": "foo"}}`
---
### Author:  [@Chris\_Meyer](https://discuss.elastic.co/u/Chris_Meyer)
#### Post date: [January 2, 2019, 5:07pm UTC](https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374/6 "2019-01-02T17:07:34Z")
OH! I missed that. Thanks for the help! 😁
---
### Author:  [@Chris\_Meyer](https://discuss.elastic.co/u/Chris_Meyer)
#### Post date: [January 2, 2019, 5:12pm UTC](https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374/7 "2019-01-02T17:12:02Z")
So to pull out what I wanted, I used:
> {{ctx.payload.hits.hits.0.\_source.message}}
Thanks again @Igor_Motov!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 30, 2019, 5:12pm UTC](https://discuss.elastic.co/t/pulling-relevant-info-out-of-logs-in-watcher-alerts/162374/8 "2019-01-30T17:12:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.