Can't get a field from the ctx.payload in Kibana watcher

I am setting up a watcher in Kibana and the watcher needs to extract different fields from the ctx.payload.
So I tried this for extracting message field from the first hit

  • {{ctx.payload.hits.hits.0._source.message}}

This gave me an error
"actions": [
{
"id": "notify-slack",
"type": "slack",
"status": "failure",
"reason": "GeneralScriptException[Error running inline script [Message is {{ctx.payload.hits.hits.0._source.message}}] using lang [mustache]]; nested: MustacheException[Failed to get value for ctx.payload.hits.hits.0._source.message @[query-template:1]]; nested: MustacheException[0 @[query-template:1]]; nested: IndexOutOfBoundsException[0]; "
}

How can I extract the message field from this JSON response?

Hi @Preetiv,

That syntax looks right to me. Can you show me the rest of the watch, and a sample of the data from the input?

Hi @chrisronline ,
My watch looks like this:

{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "logstash*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "\"k8s\"",
                    "analyze_wildcard": true
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-60m"
                    }
                  }
                }
              ],
              "must_not": []
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "notify-slack": {
      "slack": {
        "account": "alerts-test",
        "message": {
          "from": "testbot",
          "to": [
            "#alerts-test"
          ],
          "text": "TEST watch context",
          "attachments": [
            {
              "color": "danger",
              "title": "TEST - Parse watch context ",
              "text": "Message is {{ctx.payload.hits.hits.0._source.message}}"
            }
          ]
        }
      }
    }
  }
}

And the simulation output is:

    "condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          "ctx.payload.hits.total": 1750671
        }
      }
    },
    "actions": [
      {
        "id": "notify-slack",
        "type": "slack",
        "status": "failure",
        "reason": "GeneralScriptException[Error running inline script [Message is {{ctx.payload.hits.hits.0._source.message}}] using lang [mustache]]; nested: MustacheException[Failed to get value for ctx.payload.hits.hits.0._source.message @[query-template:1]]; nested: MustacheException[0 @[query-template:1]]; nested: IndexOutOfBoundsException[0]; "
      }
    ]
  },
  "messages": []
}

The 'size' of the 'body' in 'input' section was wrongly set to '0' and hence the issue.
Changed it to 10 and it worked.

Great! Glad you figured it out!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.