How to send mail to matched username from rule

Hi, I have rule (type change) to detect user login from new IP. Now i want send mail to that user. How can ? for example :

filter:
- query:
    query_string:
      query: "type: ssh"
#- term:
#    type: "ssh"
# (Required)
# The alert is use when a match is found
alert_text: |
    New login from {0} for user {1} at {2}
alert_text_args:
  - src_ip
  - username
  - timestamp
alert_text_type: alert_text_only

I want to send mail to {username}

Thanks!

[Qmando]

If you need to normalize the data, either do it before it goes into Elasticsearch (like with logstash), or you need to write an enhancement.

http://elastalert.readthedocs.io/en/latest/recipes/adding_enhancements.html#enhancements

In the enhancement, do something like match['username_field'] = normalize(match['username_field'])

[Qmando]

You need to add a default email.

email: "[e-mail]"