# 7.12.1 threshold rule, group by field within actions **URL:** \ **Category:** Elastic Security\ **Created:** [May 5, 2021, 2:41pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209 "2021-05-05T14:41:53Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\ **Post date:** [May 5, 2021, 2:41pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209/1 "2021-05-05T14:41:53Z")
Hi, With 7.12.1 i can see our group by field appearing in the detection event, in this case it is host.name. I have tried pushing through within the actions but it is still empty. I am trying to access this data in several ways ```auto {{context.alerts.0.host.name}} {{#context.alerts}} host.name: {{host.name}} {{/context.alerts}} {{context.alerts}} ``` I dumped out the full event with context.alerts and pumped the output to a json editor and it does not look as though host.name is nested - "host.name":"somecomputer", i am using host.name within actions in normal detections successfully. Thanks Phil ---
**Author:** ![madi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madi/32/75699_2.png) [@madi](https://discuss.elastic.co/u/madi)\ **Post date:** [May 5, 2021, 3:18pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209/2 "2021-05-05T15:18:40Z")
Hi @probson, thanks for your question! You need a second loop to iterate over the `threshold_result` terms and pick out the matching field that you're interested in (or print them all). Since threshold signals are synthetic signals over a group of events, they don't necessarily look exactly like the source events. Fields that are included in the "group by" set can be found in the `threshold_result.terms` object. You can see an example in the issue here that is fixed in 7.12.1: [[Security Solution][Detections] Threshold signal fields are not available in Actions context · Issue #94699 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/94699#issuecomment-820379018) Hope this helps! Madi ---
**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\ **Post date:** [May 10, 2021, 7:19am UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209/3 "2021-05-10T07:19:24Z")
@madi Do you know if the fields will be directly accessible in the future? In my example, host.name which is one of the group fields is available in the context.alerts but its output is not ECS compliant Thanks Phil ---
**Author:** ![madi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madi/32/75699_2.png) [@madi](https://discuss.elastic.co/u/madi)\ **Post date:** [May 13, 2021, 3:47pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209/4 "2021-05-13T15:47:12Z")
@probson You mean that it's not ECS-compliant because it's not located in the `host.name` top-level field? I believe we could copy the data into the original location for fields that have been grouped by. I don't know of any plans to do so, but I see no reason why we couldn't. ---
**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\ **Post date:** [May 13, 2021, 4:17pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209/5 "2021-05-13T16:17:41Z")
@madi , Thats it, as of 7.12.1 the group by fields look to be copied from the signal.threshold\_result.terms "field":"host.name","value":"somecomputer" to the original field name of host.name but host.name within the action output is not ECS compliant ---
**Author:** ![madi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/madi/32/75699_2.png) [@madi](https://discuss.elastic.co/u/madi)\ **Post date:** [May 18, 2021, 2:43pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209/6 "2021-05-18T14:43:09Z")
@probson We will consider implications of adding them back as part of: [[Security Solution][Detections] Migrating Detections to the new .alerts indices · Issue #100103 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/100103) ... in the meantime, I've made a docs update to help address this concern: [[DOCS] Add documentation about creating Threshold Rule actions by madirey · Pull Request #687 · elastic/security-docs · GitHub](https://github.com/elastic/security-docs/pull/687). Thanks so much! Madi ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 15, 2021, 2:43pm UTC](https://discuss.elastic.co/t/7-12-1-threshold-rule-group-by-field-within-actions/272209/7 "2021-06-15T14:43:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.