# Split Alert Message in Elasticsearch Query type Alert

**URL:** <https://discuss.elastic.co/t/split-alert-message-in-elasticsearch-query-type-alert/325226>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [February 10, 2023, 8:56am UTC](https://discuss.elastic.co/t/split-alert-message-in-elasticsearch-query-type-alert/325226 "2023-02-10T08:56:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [February 10, 2023, 8:56am UTC](https://discuss.elastic.co/t/split-alert-message-in-elasticsearch-query-type-alert/325226/1 "2023-02-10T08:56:38Z")

</div>

Hi there,

i want to ask about alerting message. i was created an alert using elasticsearch query to find some cert that close to it's expire date and i used server log connector. the alert is running as well, but the problem is if there are two or more cert detected will expire, the alert that i made printed the log in one line like this:

 ![gambar](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d4f3590b30e17f0baed960deac4f4193d3ba346.png)

and i need it to print the log in one line. so if there are 2 or more cert detected, it will print 2 lines of log. Here is my elasticsearch query in this alert:

```auto
{
  "query":{
  "bool": {
      "filter": [
        {
          "script": {
            "script": {
              "source": "boolean lt(Supplier s, def v) {return s.get() < v} boolean gte(Supplier s, def v) {return s.get() >= v}lt(() -> { def wer = doc['tls.certificate_not_valid_after'].value.millis;\r\ndef wes = doc['@timestamp'].value.millis;\r\ndef was = wer - wes;\r\n\r\nreturn was / 1000 / 60 / 60 / 24; }, params.lt) && gte(() -> { def wer = doc['tls.certificate_not_valid_after'].value.millis;\r\ndef wes = doc['@timestamp'].value.millis;\r\ndef was = wer - wes;\r\n\r\nreturn was / 1000 / 60 / 60 / 24; }, params.gte)",
              "params": {
                "lt": 30,
                "gte": 1,
                "value": "<30 >=1"
              },
              "lang": "painless"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

```

fyi, i made a field using scripted field and using that field to measure certificate expiration

back to the question: is it possible to split log message above? be in accordance with the number of cert detected

Here is my template message:  
 ![gambar](https://us1.discourse-cdn.com/elastic/original/3X/1/6/169064c641c34f5dfa81d53f2229eac5f1b5a7ef.png)

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2023, 8:57am UTC](https://discuss.elastic.co/t/split-alert-message-in-elasticsearch-query-type-alert/325226/2 "2023-03-10T08:57:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.