# Unable to receive source fields over email from Watcher alerting
**URL:** https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [April 12, 2021, 4:35pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914 "2021-04-12T16:35:09Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@arunhk3](https://discuss.elastic.co/u/arunhk3)
#### Post date: [April 12, 2021, 4:35pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914/1 "2021-04-12T16:35:09Z")
Hi All,
I have been trying for nearly 4 hours already to get an email alert with data table using Watcher, despite receiving the email it fails to send the data using the \_source fields specified. My Watcher alert is as below:
```auto
{
"trigger": {
"schedule": {
"interval": "2m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-5m"
}
}
}
],
"must_not": [
{
"match": {
"response": 200
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"xxxxxx@xxxxx.com"
],
"subject": "TEST Watcher Notification",
"body": {
"html": "There is a total of {{ctx.payload.hits.total}} errors so far in the last 5 minutes.
Snapshot of errors:
| Timestamp | Client_IP | Response_Code |
|---|
{{#ctx.payload.hits.hits}}| {{_source.timestamp}} | {{_source.clientip}} | {{_source.response}} | {{/ctx.payload.hits.hits}}
"
}
}
}
}
}
```
When the email is triggered, I get the below email but with no data.
A sample document is as below:
```auto
{
"host" : "elastic",
"message" : "92.115.179.247 - - [20/May/2015:21:05:35 +0000] \"GET /favicon.ico HTTP/1.1\" 304 3638 \"-\" \"Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:20.0) Gecko/20100101 Firefox/20.0\"",
"auth" : "-",
"ident" : "-",
"httpversion" : "1.1",
"verb" : "GET",
"path" : "/var/log/test.log",
"clientip" : "92.115.179.247",
"@version" : "1",
"request" : "/favicon.ico",
"response" : "304",
"@timestamp" : "2021-04-12T15:51:32.357Z",
"bytes" : "3638",
"timestamp" : "20/May/2015:21:05:35 +0000"
}
```
I am not sure what I am missing here and even after such a long stretch I am unable to make it work 😟
Kindly help!
Thanks,
Arun
---
### Author:  [@wayneseymour](https://discuss.elastic.co/u/wayneseymour)
#### Post date: [April 15, 2021, 2:07pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914/2 "2021-04-15T14:07:54Z")
@arunhk3 I'm gonna try to mock this up on my local. I'll let you know what I learn soon.
---
### Author:  [@wayneseymour](https://discuss.elastic.co/u/wayneseymour)
#### Post date: [April 15, 2021, 6:40pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914/3 "2021-04-15T18:40:57Z")
@arunhk3 hey there, in what version of kibana is this problem occurring for you?
---
### Author:  [@wayneseymour](https://discuss.elastic.co/u/wayneseymour)
#### Post date: [April 15, 2021, 7:21pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914/4 "2021-04-15T19:21:24Z")
@arunhk3 Actually I was looking at the data requested vs the email received and it looks like you did at least receive `There is a total of {{ctx.payload.hits.total}} errors so far in the last 5 minutes` and then it is "broken" after the start of an html tag. I wonder if html is allowed in that stanza? (puts on thinking hat)
@arunhk3 can you try sending an email with that same json, but dropping all the html? Actually, since you and I can see some of the data came through, perhaps we only add that and the parts that have not. Such as: `{{_source.timestamp}} && {{_source.clientip}} && {{_source.response}}`
---
### Author:  [@Rem](https://discuss.elastic.co/u/Rem)
#### Post date: [April 16, 2021, 2:18pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914/5 "2021-04-16T14:18:20Z")
It does not work, nothing is printed by adding those variables.
---
### Author:  [@arunhk3](https://discuss.elastic.co/u/arunhk3)
#### Post date: [April 19, 2021, 3:44pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914/6 "2021-04-19T15:44:06Z")
This actually is working in another instance in my workplace but not in my VM box when I tried it. Also as you can see from my screenshot it says:
`"There is a total of 2 errors"`
I will try your suggestion and get back to you. Thanks a ton for your input!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 17, 2021, 3:44pm UTC](https://discuss.elastic.co/t/unable-to-receive-source-fields-over-email-from-watcher-alerting/269914/7 "2021-05-17T15:44:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.