You would have routied the alert event to a REST service instead of writing to the SNS notification group. The web service uses the "event name" and timestamp to generate a custom notification. It pulls diagnostic information from several services, including our ELK stack, and includes it in the custom notification along with the typical Cloudwatch Alert data. The web services them and sends the custom notification to the original SNS notification group to be distributed.