# Advice on transform in watcher Slack action, please

**URL:** <https://discuss.elastic.co/t/advice-on-transform-in-watcher-slack-action-please/187436>\
**Category:** Elasticsearch\
**Created:** [June 25, 2019, 9:59pm UTC](https://discuss.elastic.co/t/advice-on-transform-in-watcher-slack-action-please/187436 "2019-06-25T21:59:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![do.ac](https://avatars.discourse-cdn.com/v4/letter/d/ea5d25/32.png) [@do.ac](https://discuss.elastic.co/u/do.ac)\
**Post date:** [June 25, 2019, 9:59pm UTC](https://discuss.elastic.co/t/advice-on-transform-in-watcher-slack-action-please/187436/1 "2019-06-25T21:59:24Z")

</div>

New to this, and would appreciate some advice (and links to documentation, if I've missed any that could have answered my question).

I am trying to create dynamic attachments for a Slack watcher action, which I've cobbled together from other examples I've found:

```
"transform": {
    "script": {
      "source": "ctx.payload.hits.total=ctx.payload.hits.total; ['items': ctx.payload.hits.hits.collect(foo -> ['region': foo._source.geoip.region_name, 'time': foo._source['audit.eventTimestamp'], 'email': foo._source['audit.principalEmail'], 'index': foo._index, 'docid': foo._id, 'methodName': foo._source['audit.methodName']])]",
      "lang": "painless"
    }
  },

```

This creates the index for the dynamic attachments just fine. What isn't working is to somehow carry over the ctx.payload.hits.total value so that I include the total number of hits in the Slack title as well... What am I doing wrong here?

Thanks!!

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 1, 2019, 7:01am UTC](https://discuss.elastic.co/t/advice-on-transform-in-watcher-slack-action-please/187436/2 "2019-07-01T07:01:11Z")

</div>

Hey,

how about creating an empty map, assigning `hits.total` and then use that map in to assign `items` like this

```auto
def data = [:];
data.total_hits = ctx.payload.hits.total
data.items = ctx.payload.hits.hits.collect ... ;
return data;

```

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2019, 7:01am UTC](https://discuss.elastic.co/t/advice-on-transform-in-watcher-slack-action-please/187436/3 "2019-07-29T07:01:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.