# Reference Different Log Than Alerting On

**URL:** <https://discuss.elastic.co/t/reference-different-log-than-alerting-on/364419>\
**Category:** Kibana\
**Created:** [August 5, 2024, 8:42pm UTC](https://discuss.elastic.co/t/reference-different-log-than-alerting-on/364419 "2024-08-05T20:42:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sfageol](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@sfageol](https://discuss.elastic.co/u/sfageol)\
**Post date:** [August 5, 2024, 8:42pm UTC](https://discuss.elastic.co/t/reference-different-log-than-alerting-on/364419/1 "2024-08-05T20:42:53Z")

</div>

I am setting up a "Rule". I send a request and that request might have 500 log lines. I have a "final failure" log line that I need to alert off of, but the failure reason is in a separate log line. Is it possible to display a separate log line in the body of an email relay?

So "final failure" triggers the rule but the email references a different log line using a value that associates the 2 logs as part of a single request.

---

<div class="post-metadata">

**Author:** ![sfageol](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@sfageol](https://discuss.elastic.co/u/sfageol)\
**Post date:** [August 13, 2024, 5:05pm UTC](https://discuss.elastic.co/t/reference-different-log-than-alerting-on/364419/2 "2024-08-13T17:05:01Z")

</div>

Bump

---

<div class="post-metadata">

**Author:** ![sfageol](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@sfageol](https://discuss.elastic.co/u/sfageol)\
**Post date:** [August 22, 2024, 8:52pm UTC](https://discuss.elastic.co/t/reference-different-log-than-alerting-on/364419/3 "2024-08-22T20:52:39Z")

</div>

Anyone?