Need multiple filter condition for alerting during create monitor

[Kanmanir]

Hi,

I need information on how to show the CPEs IP in email configuration. and how to add many filters during create monitoring.
Iam using an elasticsearch and kibana opendistro images of version 1.13.1.

I have 4 CPEs [CPE01, CPE02, CPE03, CPE04] and connected 4 interfaces [ETH00, ETH01, LAN00, LAN01] for each CPE's. I downed one of the CPEs interface[For example ETH00] and i get a log message in kibana as ETH00: Link is Down in syslog_message field and <158>Dec 2 07:14:01 cpe-base root: ETH00: Link is Down in message field

I created one monitor and trigger to check which interface is down using the visuals graph as follows when COUNT() OVER all documents FOR THE Last 1 hour(s) WHERE syslog_message is ETH00: Link is Down. Created an trigger and action as email destination.

My requirement is:
1) How can i know which CPEs ETH00 interface is down and i need to dynamically pass that CPEs IP in email subject and in mustache template.
2) How to add multiple filters during create monitor.