Thanks I will look into the logstash method.
Any ideas on when Watcher may have some sort of looped sub actions feature?
Also, is there any way I could loop through the ctx.payload.hits.hits indexes to retrieve all the hosts and send them to my api using just one webhook action, or is there no way to loop at all?