Access event fields for connector action

Elastic Stack Elasticsearch
1

Hi,

I am trying to create an alert which utilises the index connector. The connector works fine and writes to the index, however I have been unable to populate any data from the event itself.

What I want is something like:

{
  "timestamp": <timestamp of the actual event>,
  "message": <the message field from the actual event>
}

I have tried using various forms of the mustache format, with ctx.payload etc ... but so far the index fields just say "empty".

Any help would appreciated. Thanks