I have rule created in ESA to fire on specific criteria in Web logs. I have added the GeoIP as an enrichmnet (lookup based on ip_src. All this works just fine. As part of the rule I want to fire off an e-mail alert, but I only want to include one element (region) of the GeoIP enrichment date not all the elements. Does anyone know how I can reference just the one element in the e-mail template. I have tried
<#list events as metadata>
but that does not appear to work.
Any suggestions would be greatly appreciated.