Watcher alert, ssh auth

hey there, i'm new using elastic and i just wanna asking about alerting. i make an alert through email. but i don't know how the user id showed up at body email and the count the user try. btw this for ssh auth.

thanks

Can you show us the Watcher that you are trying to use?