what does include_match_in_root do?

[sucremad]

Hi,

I could not see include_match_in_root in the documentation. What is it for? could you please explain?

[jertel]

It adds all the matched record key/value pairs into the alert body content, which is usually the main body of an alert, like a Slack message, or email body.

[nsano-rururu]

A note about include_match_in_root. Items whose first character is _ are not applicable.

elastalert2/elastalert/elastalert.py

Lines 1437 to 1438 in 93f8510

	if rule.get('include_match_in_root'):
	body.update({k: v for k, v in match.items() if not k.startswith('_')})