# The content of the field is not shown in alert
**URL:** https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [July 14, 2022, 11:25am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637 "2022-07-14T11:25:08Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@csaba.g](https://discuss.elastic.co/u/csaba.g)
#### Post date: [July 14, 2022, 11:25am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/1 "2022-07-14T11:25:08Z")
Hello,
I defined an Alert Rule with Connector email. I would like to have in the received email the particular message, for which we defined the condition. The field which I would like to see is `message`. I tried different ways/formats in the email message body to see the content of the `message` field, however it doesn't work. I tried the following formats:
```auto
{{message}}
{{.message}}
{{/message}}
{{#message}}
{{_message}}
```
Could you please help me to find out which format I should use to see the particular error message in the email? In all above cases the string was shown, not the content.
Thanks a lot.
Elastic version: 7.16.1
---
### Author:  [@gmmorris](https://discuss.elastic.co/u/gmmorris)
#### Post date: [July 14, 2022, 11:27am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/2 "2022-07-14T11:27:48Z")
Hey @csaba.g ,
Welcome to the community.
The ability to include this data depends on the specific rule - could you clarify which rule type you're using?
If you're using the [ES Query](https://www.elastic.co/guide/en/kibana/7.16/rule-type-es-query.html) rule type then you should be able to use the `context.hits` variable as described in the docs.
---
### Author:  [@csaba.g](https://discuss.elastic.co/u/csaba.g)
#### Post date: [July 14, 2022, 12:58pm UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/3 "2022-07-14T12:58:20Z")
Thanks for the fast feedback.
We do use the Log threshold - maybe not he best choice, but is there a way to include this data in this rule type?
We can also try the ES Query.
Thanks a lot
---
### Author:  [@csaba.g](https://discuss.elastic.co/u/csaba.g)
#### Post date: [July 15, 2022, 9:07am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/4 "2022-07-15T09:07:34Z")
Hey @gmmorris,
I tried the ES Query and I have seen the required error message, so it works.
However, there was the whole content of the indices, so I tried to get a specific element, like
`{{context.hits.message}}`
or
`{{context.hits.meta_json}}`
but then no content was in email. Did I try it correctly? This element is not nested.
Thanks a lot
---
### Author:  [@emmma](https://discuss.elastic.co/u/emmma)
#### Post date: [July 18, 2022, 9:44am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/5 "2022-07-18T09:44:58Z")
Hi @csaba.g ,
Although `context.hits.message` is available in the index, it is not as a variable to include in the alert message sent by email. The full list of `context` variables available for Log Threshold rule connectors is:
- context.conditions
- context.denominatorConditions
- context.group
- context.isRatio
- context.matchingDocuments
- context.numeratorConditions
- context.ratio
- context.reason
- context.timestamp
- context.viewInAppUrl
See [Log Threshold Rule documentation](https://www.elastic.co/guide/en/observability/current/logs-threshold-alert.html#_action_variables) for more information.
Hope this helps.
---
### Author:  [@gmmorris](https://discuss.elastic.co/u/gmmorris)
#### Post date: [July 18, 2022, 1:51pm UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/6 "2022-07-18T13:51:44Z")
Thanks for jumping in @emmma 🙂 👋
Regarding ES Query @csaba.g , I think the syntax you need is:
```auto
{{#context.hits}}
{{meta_json}}
{{/context.hits}}
```
This is because `context.hits` is an array of docs, as described in [the documentation](https://www.elastic.co/guide/en/kibana/7.16/rule-type-es-query.html).
Let me know if this doesn't solve it for you. 😄
---
### Author:  [@csaba.g](https://discuss.elastic.co/u/csaba.g)
#### Post date: [July 18, 2022, 9:11pm UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/7 "2022-07-18T21:11:46Z")
Thanks @emmma @gmmorris
I tried your syntax, however I still cannot see the particular message. There was a blank space in the e-mail. Do you have another idea, what can be wrong? Thanks
---
### Author:  [@gmmorris](https://discuss.elastic.co/u/gmmorris)
#### Post date: [July 19, 2022, 12:54pm UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/8 "2022-07-19T12:54:15Z")
Are you sure the `meta_json` field is on the doc root itself?
One way to debug this is to dump the entire `hits` array into the email.
This is done by including the following:
```auto
{{#context.hits}}{{.}}{{/context.hits}}
```
This will iterate through each doc in the `context.hits` variable and dump the doc as is.
That way you can see exactly what fields are available and what their values are.
---
### Author:  [@csaba.g](https://discuss.elastic.co/u/csaba.g)
#### Post date: [July 21, 2022, 11:56am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/9 "2022-07-21T11:56:47Z")
Many thanks, that helped. Now I found out the structure. This is the way how it works:
```auto
{{#context.hits}}
{{_source.message}}
{{/context.hits}}
```
If I may use this round for another question:
We would like to also use the Jira connector. However there we can defne only the issue type, summary and additional comments. Is there a way to define another values, for example component? Thanks
---
### Author:  [@gmmorris](https://discuss.elastic.co/u/gmmorris)
#### Post date: [July 22, 2022, 8:38am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/10 "2022-07-22T08:38:30Z")
> [@csaba.g](#):
>
> We would like to also use the Jira connector. However there we can defne only the issue type, summary and additional comments. Is there a way to define another values, for example component? Thanks
I’m assuming you mean the `component` field [under project](https://support.atlassian.com/jira-software-cloud/docs/organize-work-with-components/)?
I’m afraid this isn’t currently possible - the Jira connector is limited to those field specified in the UX.
Feel free to [file a **feature request**](https://github.com/elastic/kibana/issues/new?assignees=&labels=&template=Feature_request.md) in the Kibana repo and we’ll look into adding it into the Connector’s roadmap.
---
### Author:  [@csaba.g](https://discuss.elastic.co/u/csaba.g)
#### Post date: [July 22, 2022, 9:21am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/11 "2022-07-22T09:21:50Z")
@gmmorris many thanks. Yes I meant the component under Jira project. Alright I will request this feature.
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 19, 2022, 9:22am UTC](https://discuss.elastic.co/t/the-content-of-the-field-is-not-shown-in-alert/309637/12 "2022-08-19T09:22:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.