# Variables and subfields

**URL:** https://discuss.elastic.co/t/variables-and-subfields/346554
**Category:** Elastic Security
**Created:** [November 6, 2023, 7:01pm UTC](https://discuss.elastic.co/t/variables-and-subfields/346554 "2023-11-06T19:01:16Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![B-Rad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/b-rad/32/127210_2.png) [@B-Rad](https://discuss.elastic.co/u/B-Rad)
#### Post date: [November 6, 2023, 7:01pm UTC](https://discuss.elastic.co/t/variables-and-subfields/346554/1 "2023-11-06T19:01:16Z")

</div>

When working with alerts and using variables in the connectors, is if possible to only use a subset of the data in my notifications?

For example, the field name is details, but this field looks to contain its own json data, and I only want 1 piece of that data.

currently I'm using {{{FieldName}}} which looks like this  
 ![1](https://us1.discourse-cdn.com/elastic/original/3X/6/6/667576b4cfa5a25a4a5de735ad9f7bfe532971d7.png)

But all I want ins the value of "display\_name" from the value of the root field

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 4, 2023, 7:02pm UTC](https://discuss.elastic.co/t/variables-and-subfields/346554/2 "2023-12-04T19:02:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.