Can't get a field from the ctx.payload in Kibana watcher

Elastic Stack Kibana
1

I am setting up a watcher in Kibana and the watcher needs to extract different fields from the ctx.payload.
So I tried this for extracting message field from the first hit

  • {{ctx.payload.hits.hits.0._source.message}}

This gave me an error
"actions": [
{
"id": "notify-slack",
"type": "slack",
"status": "failure",
"reason": "GeneralScriptException[Error running inline script [Message is {{ctx.payload.hits.hits.0._source.message}}] using lang [mustache]]; nested: MustacheException[Failed to get value for ctx.payload.hits.hits.0._source.message @[query-template:1]]; nested: MustacheException[0 @[query-template:1]]; nested: IndexOutOfBoundsException[0]; "
}

How can I extract the message field from this JSON response?

2

Hi @Preetiv,

That syntax looks right to me. Can you show me the rest of the watch, and a sample of the data from the input?

3

Hi @chrisronline ,
My watch looks like this:

{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "logstash*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "\"k8s\"",
                    "analyze_wildcard": true
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-60m"
                    }
                  }
                }
              ],
              "must_not": []
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "notify-slack": {
      "slack": {
        "account": "alerts-test",
        "message": {
          "from": "testbot",
          "to": [
            "#alerts-test"
          ],
          "text": "TEST watch context",
          "attachments": [
            {
              "color": "danger",
              "title": "TEST - Parse watch context ",
              "text": "Message is {{ctx.payload.hits.hits.0._source.message}}"
            }
          ]
        }
      }
    }
  }
}

And the simulation output is:

    "condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          "ctx.payload.hits.total": 1750671
        }
      }
    },
    "actions": [
      {
        "id": "notify-slack",
        "type": "slack",
        "status": "failure",
        "reason": "GeneralScriptException[Error running inline script [Message is {{ctx.payload.hits.hits.0._source.message}}] using lang [mustache]]; nested: MustacheException[Failed to get value for ctx.payload.hits.hits.0._source.message @[query-template:1]]; nested: MustacheException[0 @[query-template:1]]; nested: IndexOutOfBoundsException[0]; "
      }
    ]
  },
  "messages": []
}
4

The 'size' of the 'body' in 'input' section was wrongly set to '0' and hence the issue.
Changed it to 10 and it worked.

5

Great! Glad you figured it out!