You have a couple options to figure out which metakeys and metavalues are in the raw alert.
The first is to look at the raw alert and use that that to modify your template to include the meta that you find there. The other option is to simply add every single metakey you have within your NetWitness environment.
FWIW, I think the second option hereis a better overall choice as it will likely require less management of ESA templates as a whole. There will be a larger initial time investment to create a template with every metakey in your environment, but once created you would only need to update that template if / when you add new metakey definitions to your index-<service>-custom.xml files.
If you go with the first option, depending on what version of NetWitness you're on, you'll be able to find the raw log in one of two places.
If you're on 10.6.x, browse to Alerts --> Summary, click into any of your existing ESA alerts, and then double-click on any of the events in that list. You can then expand the field within the Event Meta tab to view all the meta associated with the events that triggered the alert:
If you're on 11.x, raw alerts can be viewed within the Respond module at Respond --> Alerts and then by selecting any of the Alerts present. The raw alert contents will appear in a sidebar to the right if you simply select an alert, or in a sidebar to the left if you click into an alert:
You can then use these details to know which meta exist for any particular alert and adjust your alert template accordingly.