# Can't get a field from the ctx.payload in Kibana watcher
**URL:** https://discuss.elastic.co/t/cant-get-a-field-from-the-ctx-payload-in-kibana-watcher/124481
**Category:** Kibana
**Created:** [March 19, 2018, 5:12am UTC](https://discuss.elastic.co/t/cant-get-a-field-from-the-ctx-payload-in-kibana-watcher/124481 "2018-03-19T05:12:39Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Preetiv](https://discuss.elastic.co/u/Preetiv)
#### Post date: [March 19, 2018, 5:12am UTC](https://discuss.elastic.co/t/cant-get-a-field-from-the-ctx-payload-in-kibana-watcher/124481/1 "2018-03-19T05:12:39Z")
I am setting up a watcher in Kibana and the watcher needs to extract different fields from the ctx.payload.
So I tried this for extracting message field from the first hit
- {{ctx.payload.hits.hits.0.\_source.message}}
This gave me an error
"actions": [
{
"id": "notify-slack",
"type": "slack",
"status": "failure",
"reason": "GeneralScriptException[Error running inline script [Message is {{ctx.payload.hits.hits.0.\_source.message}}] using lang [mustache]]; nested: MustacheException[Failed to get value for ctx.payload.hits.hits.0.\_source.message @[query-template:1]]; nested: MustacheException[0 @[query-template:1]]; nested: IndexOutOfBoundsException[0]; "
}
How can I extract the message field from this JSON response?
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [March 19, 2018, 1:07pm UTC](https://discuss.elastic.co/t/cant-get-a-field-from-the-ctx-payload-in-kibana-watcher/124481/2 "2018-03-19T13:07:17Z")
Hi @Preetiv,
That syntax looks right to me. Can you show me the rest of the watch, and a sample of the data from the input?
---
### Author:  [@Preetiv](https://discuss.elastic.co/u/Preetiv)
#### Post date: [March 19, 2018, 4:06pm UTC](https://discuss.elastic.co/t/cant-get-a-field-from-the-ctx-payload-in-kibana-watcher/124481/3 "2018-03-19T16:06:45Z")
Hi @chrisronline ,
My watch looks like this:
```auto
{
"trigger": {
"schedule": {
"interval": "30m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "\"k8s\"",
"analyze_wildcard": true
}
},
{
"range": {
"@timestamp": {
"gte": "now-60m"
}
}
}
],
"must_not": []
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"notify-slack": {
"slack": {
"account": "alerts-test",
"message": {
"from": "testbot",
"to": [
"#alerts-test"
],
"text": "TEST watch context",
"attachments": [
{
"color": "danger",
"title": "TEST - Parse watch context ",
"text": "Message is {{ctx.payload.hits.hits.0._source.message}}"
}
]
}
}
}
}
}
```
And the simulation output is:
```auto
"condition": {
"type": "compare",
"status": "success",
"met": true,
"compare": {
"resolved_values": {
"ctx.payload.hits.total": 1750671
}
}
},
"actions": [
{
"id": "notify-slack",
"type": "slack",
"status": "failure",
"reason": "GeneralScriptException[Error running inline script [Message is {{ctx.payload.hits.hits.0._source.message}}] using lang [mustache]]; nested: MustacheException[Failed to get value for ctx.payload.hits.hits.0._source.message @[query-template:1]]; nested: MustacheException[0 @[query-template:1]]; nested: IndexOutOfBoundsException[0]; "
}
]
},
"messages": []
}
```
---
### Author:  [@Preetiv](https://discuss.elastic.co/u/Preetiv)
#### Post date: [March 19, 2018, 10:55pm UTC](https://discuss.elastic.co/t/cant-get-a-field-from-the-ctx-payload-in-kibana-watcher/124481/4 "2018-03-19T22:55:29Z")
The 'size' of the 'body' in 'input' section was wrongly set to '0' and hence the issue.
Changed it to 10 and it worked.
---
### Author:  [@chrisronline](https://discuss.elastic.co/u/chrisronline)
#### Post date: [March 20, 2018, 1:11pm UTC](https://discuss.elastic.co/t/cant-get-a-field-from-the-ctx-payload-in-kibana-watcher/124481/5 "2018-03-20T13:11:28Z")
Great! Glad you figured it out!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 17, 2018, 1:11pm UTC](https://discuss.elastic.co/t/cant-get-a-field-from-the-ctx-payload-in-kibana-watcher/124481/6 "2018-04-17T13:11:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.