Cannot figure out how to get data from _source into Watch Output

Elastic Stack Elasticsearch
7

Here is that output.....had to remove some info since it is sensitive so you may see a lot of "xxx" and "xxxx". Also to save space I removed a lot of the results as there were 240 of them. Thanks for your input.

{
  "watch_id": "Errors",
  "state": "executed",
  "_status": {
    "state": {
      "active": true,
      "timestamp": "2017-05-22T14:12:45.110Z"
    },
    "last_checked": "2017-05-22T14:51:45.250Z",
    "last_met_condition": "2017-05-22T14:51:45.250Z",
    "actions": {
      "my-logging-action": {
        "ack": {
          "timestamp": "2017-05-22T14:13:45.372Z",
          "state": "ackable"
        },
        "last_execution": {
          "timestamp": "2017-05-22T14:51:45.250Z",
          "successful": true
        },
        "last_successful_execution": {
          "timestamp": "2017-05-22T14:51:45.250Z",
          "successful": true
        }
      }
    }
  },
  "trigger_event": {
    "type": "schedule",
    "triggered_time": "2017-05-22T14:51:45.250Z",
    "schedule": {
      "scheduled_time": "2017-05-22T14:51:45.054Z"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "filebeat*"
        ],
        "types": [],
        "body": {
          "query": {
            "exists": {
              "field": "error_data"
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.execution_time": {
        "gte": "<{now-5m}>"
      }
    }
  },
  "metadata": {
    "name": "Error Alerts"
  },
  "result": {
    "execution_time": "2017-05-22T14:51:45.250Z",
    "execution_duration": 31,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 240,
          "failed": 0,
          "successful": 240
        },
        "hits": {
          "hits": [
            {
              "_index": "filebeat-2017.04.05",
              "_type": "log",
              "_source": {
                "offset": 49936,
                "target_url": "https://xxx",
                "input_type": "log",
                "source": "/var/local/xxx/yyy_yyy40.log.04-05-2017",
                "message": "04/05/2017 05:02:33 instance|9999999\tfetch_time|31.614\ttotal_accounts|\trt_accounts|\trt_account_status|Fail\trt_time_acct|\terror_data|Unable to extract data\ttarget_url|https://xxx\tuserlogon|xxx",
                "type": "log",
                "tags": [
                  "beats_input_codec_plain_applied",
                  "i_9999999",
                  "fi_xxxx_xxxx40"
                ],
                "fetch_time": "31.614",
                "instance_num": "9999999",
                "@timestamp": "2017-04-05T10:02:33.000Z",
                "@version": "1",
                "beat": {
                  "hostname": "xxx.local",
                  "name": "xxx.local",
                  "version": "5.4.0"
                },
                "host": "xxx.local",
                "rt_account_status": "Fail",
                "fi_endpoint": "xxx_xxxx40",
                "timestamp": "04/05/2017 05:02:33",
                "error_data": "Unable to extract data"
              },
              "_id": "AVwTSYCn9e7I6Rr1_O2v",
              "_score": 1
            },
            {
              "_index": "filebeat-2017.04.05",
              "_type": "log",
              "_source": {
                "offset": 171304,
                "target_url": "https://xxxx",
                "input_type": "log",
                "source": "/var/local/xxx/xxxx_xxxx40.log.04-05-2017",
                "message": "04/05/2017 17:10:33 instance|9999998\tfetch_time|31.255\ttotal_accounts|\trt_accounts|\trt_account_status|Fail\trt_time_acct|\terror_data|Unable to extract data\ttarget_url|https://xxx\tuserlogon|xxx",
                "type": "log",
                "tags": [
                  "beats_input_codec_plain_applied",
                  "i_9999998",
                  "fi_xxxx_xxxx40"
                ],
                "fetch_time": "31.255",
                "instance_num": "9999998",
                "@timestamp": "2017-04-05T22:10:33.000Z",
                "@version": "1",
                "beat": {
                  "hostname": "xxx.local",
                  "name": "xxx.local",
                  "version": "5.4.0"
                },
                "host": "xxx.local",
                "rt_account_status": "Fail",
                "fi_endpoint": "xxxx_xxxx40",
                "timestamp": "04/05/2017 17:10:33",
                "error_data": "Unable to extract account overview data"
              },
              "_id": "AVwTUf0v9e7I6Rr1_RuS",
              "_score": 1
            }
          ],
          "total": 174881,
          "max_score": 1
        },
        "took": 29,
        "timed_out": false
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "filebeat*"
          ],
          "types": [],
          "body": {
            "query": {
              "exists": {
                "field": "error_data"
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          "ctx.execution_time": "2017-05-22T14:51:45.250Z",
          "now-5m": "2017-05-22T14:46:45.295Z"
        }
      }
    },
    "actions": [
      {
        "id": "my-logging-action",
        "type": "logging",
        "status": "success",
        "logging": {
          "logged_text": " had an error of  at 2017-05-22T14:51:45.250Z"
        }
      }
    ]
  },
  "messages": []
}