# Can I use "script" to truncate a field so it's 950 characters or less in a watcher?

**URL:** https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277
**Category:** Elasticsearch
**Created:** [January 15, 2021, 3:09pm UTC](https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277 "2021-01-15T15:09:31Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)
#### Post date: [January 15, 2021, 3:09pm UTC](https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277/1 "2021-01-15T15:09:31Z")

</div>

So, we use PagerDuty as an action for our alerts.

Unfortunately, with this action you can only set `description` so we must try to plug as much information into the field before we fire off the alert. Sometimes this means that the field is more than 1024 characters and then gets rejected by Pagerduty:

```auto
"body": "{\"status\":\"invalid event\",\"message\":\"Event object is invalid\",\"errors\":[\"'summary' is too long (maximum is 1024 characters)\"]}"

```

I have been looking at trying to truncate that field to just send the first 950 characters, then ignore anything else, and stumbled across `painless` and followed an example here:

```auto
"transform" : {
    "script": {
      "source" : "ctx.payload.hits.hits.0._source.log_message(e -> e.a.substring(0, (int) Math.min(e.a.length(), 1000)))",
      "lang": "painless"
    }
  },

```

```auto
"actions": {
    "notify-pagerduty" : {
      "pagerduty" : {
        "account": "my_pagerduty_account",
        "description" : "X Console Error - {{ ctx.payload.hits.hits.0._source.agent.hostname }}/{{ ctx.payload.hits.hits.0._source.fields.environment }} - {{ ctx.payload.hits.hits.0._source.log_message }}",
        "attach_payload" : true,
        "contexts" : [
          {
            "type": "link",
            "href": "X",
            "text": "View the incident on {{ctx.payload.link}}"
          }
        ]
      }
    },

```

So essentially, I would up with a partial `log_message` which is fine at this stage as we would have enough information.

Unfortunately, i'm finding it hard to find much documentation on the `painless` language, and to be honest, not really sure where I can begin.

---

<div class="post-metadata">

### Author: ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)
#### Post date: [January 26, 2021, 12:06pm UTC](https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277/2 "2021-01-26T12:06:38Z")

</div>

I gave up with this and truncated it at a logstash level instead.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 23, 2021, 12:06pm UTC](https://discuss.elastic.co/t/can-i-use-script-to-truncate-a-field-so-its-950-characters-or-less-in-a-watcher/261277/3 "2021-02-23T12:06:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
