# Watcher alerts, customizing message from Kibana Ui
**URL:** https://discuss.elastic.co/t/watcher-alerts-customizing-message-from-kibana-ui/141670
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [July 25, 2018, 11:32pm UTC](https://discuss.elastic.co/t/watcher-alerts-customizing-message-from-kibana-ui/141670 "2018-07-25T23:32:21Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@palace](https://discuss.elastic.co/u/palace)
#### Post date: [July 25, 2018, 11:32pm UTC](https://discuss.elastic.co/t/watcher-alerts-customizing-message-from-kibana-ui/141670/1 "2018-07-25T23:32:21Z")
Hello all,
I am able to send notifications of possible anomalies to my slack space. However, I am trying to customize the message to include information surrounding the anomaly such as the [ID, timestamp, typical, actual, record\_score, type] etc.
I am trying to create the message from the kibana watcher UI and I currently have this:
Watch {{ctx.metadata.name}} has exceeded the threshold {{ctx.metadata.watcherui.threshold}}
Thank you in advance
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 26, 2018, 9:23am UTC](https://discuss.elastic.co/t/watcher-alerts-customizing-message-from-kibana-ui/141670/2 "2018-07-26T09:23:30Z")
the [watch execution context](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/how-watcher-works.html#watch-execution-context) contains all those information. If you are unsure what is in there (because it depends on the input and in your example on the search response itself), the easiest way to find out, would be to use the execute watch API. the you can a `logging` action and just log out the full context via `"text" : "{{ctx}}"` - this will show you all the data that is available.
---
### Author:  [@palace](https://discuss.elastic.co/u/palace)
#### Post date: [July 26, 2018, 11:03pm UTC](https://discuss.elastic.co/t/watcher-alerts-customizing-message-from-kibana-ui/141670/3 "2018-07-26T23:03:58Z")
Hello,
I am able to get information about ctx but not information by query such as
{{\_source.record\_score}} or {{fields.timestamp}} or {{\_source.typical}} etc.
Let me know if you need the JSON to further understand my problem.
Thank you again,
Alice
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 27, 2018, 7:51am UTC](https://discuss.elastic.co/t/watcher-alerts-customizing-message-from-kibana-ui/141670/4 "2018-07-27T07:51:00Z")
Accessing hits data requires you to access the `ctx.payload.hits.hits` array.
Take a look at the [Alerting examples](https://github.com/elastic/examples/tree/master/Alerting) in our examples repo, which makes use of that.
--Alex
---
### Author:  [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [July 27, 2018, 1:55pm UTC](https://discuss.elastic.co/t/watcher-alerts-customizing-message-from-kibana-ui/141670/5 "2018-07-27T13:55:54Z")
The following blogs on ML Scoring and Alerting might be helpful:
> **[Alerting on Machine Learning Jobs in Elasticsearch](https://www.elastic.co/blog/alerting-on-machine-learning-jobs-in-elasticsearch-v55)**
>
> How to combine machine learning and alerting for Elasticsearch to get notifications about anomalies in version 5.5.
> **[Machine Learning Anomaly Scoring and Elasticsearch - How it Works
| Elastic](https://www.elastic.co/blog/machine-learning-anomaly-scoring-elasticsearch-how-it-works)**
>
> We often get questions about Elastic’s Machine Learning “anomaly score” and how the various scores presented in the dashboards relate to the “unusualness” of individual occurrences within the da...
If you want detailed information about the `record_score`, `typical, actual`, etc you could look at this specific record-based watch example:
>
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 24, 2018, 2:10pm UTC](https://discuss.elastic.co/t/watcher-alerts-customizing-message-from-kibana-ui/141670/6 "2018-08-24T14:10:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.