Send message to email from watcher

Dear all,

I made one watcher for try to find specific sentence from my logs:

"query": {
"match": {
"Message": "Remote Desktop Services: User authentication succeeded"

Now, I want to parse rest of this log message and send to email like:
User successfully connected via RDP on from <remote_host>

I have a plan to make a one new watcher for unsuccessfully connection. It is necessary, or maybe I can write it inside this watcher?

How can I get username, hostname and remote_host in my BODY?


Ideally the message processing would be done at ingestion time extracting the fields from the message and adding them as fields to the document.

Otherwise, you can consider using a script transform construct. You can use the script transform where the script will process the text, extract the metadata and return a new structured payload that can easily be used by the actions.