DOCS-1715 - Document includeQuery and includeResult flags for monitor email notifications

blog-service/2026-07-04-manage.md

@@ -0,0 +1,11 @@
+---
+title: Include Query and Results in Monitor Email Notifications (Manage)
+image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082
+keywords:
+  - monitors
+  - alerts
+  - email notifications
+hide_table_of_contents: true
+---
+
+We're excited to introduce the `includeQuery` and `includeResultSet` flags in monitor email notifications. This helps you include the search query and search results directly in the email. [Learn more](/docs/alerts/monitors/create-monitor/#step-3-notifications-optional).

docs/alerts/monitors/create-monitor.md

@@ -438,7 +438,9 @@ Notifications will be sent when the monitor is triggered as configured in the [A
 
 * **Preferred Notification Time Zone**. Set the time zone for your alert notifications. If you do not select anything, it will default to the time zone specified in your user preferences.
 * **Connection Type**. Choose the [connection](/docs/alerts/webhook-connections) notification method (e.g., email, Webhook, PagerDuty). Monitor notifications support [Alert Variables](/docs/alerts/monitors/alert-variables) to reference its configuration settings or your raw data.
-   * **Email**. Provide 1-100 recipient email addresses. You can customize the email subject and body.
+   * **Email**. Provide 1-100 recipient email addresses. You can customize the email subject and body. You can also include additional context in the email notification:
+      * **Include Query** (`includeQuery`). Adds the monitor's search query to the email notification. Supported for Logs, Metrics, and SLO monitors.
+      * **Include Results** (`includeResultSet`). Adds the search results to the email notification. Supported for Logs and Metrics monitors. SLO monitors do not support this option. Setting `includeResultSet` on an SLO monitor returns an error indicating that the flag is not applicable.
    * **Webhook**. By default, the payload defined on the Connection is used. You can customize your payload for each notification if needed.
 * **Trigger Type Notifications**. Set different notification channels for each trigger type (**Critical**, **Warning**, **Missing Data**). Select the **Alert** and **Recovery** checkboxes for each trigger type based on when you want to send a notification. You can have different Trigger Conditions send a notification to different channels. For example, you can get notified on PagerDuty for critical Incidents and get an email or Slack notification for warning incidents.
    * For the connection types listed [here](/docs/alerts/webhook-connections), you can use the **Recovery** checkbox to enable an automatic resolution process that updates the connection when an alert has recovered within Sumo Logic.