# Can't get ctx.payload.hits.hits.index.fields.fieldname to work

**URL:** https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [July 13, 2015, 6:52pm UTC](https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471 "2015-07-13T18:52:04Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![crayy8](https://avatars.discourse-cdn.com/v4/letter/c/f07891/32.png) [@crayy8](https://discuss.elastic.co/u/crayy8)
#### Post date: [July 13, 2015, 6:52pm UTC](https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471/1 "2015-07-13T18:52:04Z")

</div>

Hi,

I am trying to get some data from the returned query results into my web hook action but I cant get it to work. The bellow is a simple example I came up with to test out what I wanted to do. ctx.payload.hits.hits.0.fields.message should be returning a hostname to me but it returns nothing.

I have tried hardcoding the hostname in place of the ctx..payload... so I know everything reaches my api fine. What am I doing wrong?

```
curl -XPUT 'http://localhost:9200/_watcher/watch/log_error_watch' -d '{
  "trigger" : { "schedule" : { "interval" : "10s" } },
  "input" : {
    "search" : {
      "request" : {
        "indices" : ["logstash-*"],
        "body" : {
          "query" : {
            "match" : { "message": "WIN7-64-VM" }
          }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
  },
  "actions" : {
    "my_webhook": {
        "webhook": {
            "method": "POST",
            "host": "myhostname",
            "port": 8080,
            "path": "/myapp/api",
            "headers" : {
                "Content-Type": "application/json",
                "Accept": "application/json"
            },
            "body": "{ \"hostName\": \"{{ctx.payload.hits.hits.0.fields.message}}\", \"userId\": \"test\"}"
        }
    }
  }
}'
```

---

<div class="post-metadata">

### Author: ![mvg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mvg/32/98890_2.png) [@mvg](https://discuss.elastic.co/u/mvg)
#### Post date: [July 14, 2015, 9:24am UTC](https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471/2 "2015-07-14T09:24:17Z")

</div>

I think you need to use the following instead:  
ctx.payload.hits.hits.0.\_source.message

Unless you specifically ask the \_search api to include stored fields in each hit, fields will be empty. By default the \_search api does return the source of a hit as was provided during indexing.

---

<div class="post-metadata">

### Author: ![crayy8](https://avatars.discourse-cdn.com/v4/letter/c/f07891/32.png) [@crayy8](https://discuss.elastic.co/u/crayy8)
#### Post date: [July 14, 2015, 1:04pm UTC](https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471/3 "2015-07-14T13:04:49Z")

</div>

You are correct, the recommendation you made works. Thanks so much Martijn!

---

<div class="post-metadata">

### Author: ![chromechris](https://avatars.discourse-cdn.com/v4/letter/c/e47c2d/32.png) [@chromechris](https://discuss.elastic.co/u/chromechris)
#### Post date: [October 28, 2016, 5:37pm UTC](https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471/4 "2016-10-28T17:37:28Z")

</div>

Hey @mvg , this also worked for me. Is there any in depth documentation for features like this? How do you come to these conclusions? Thanks in advance, Chrome.

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 31, 2016, 7:03am UTC](https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471/5 "2016-10-31T07:03:53Z")

</div>

Hey,

Netx time, can you open a new thread for those questions, please. Reviving threads that are almost 1.5 years old might become off-topic really quick.

What Martijn did here, was just checking out the JSON format of the search response and walking through it by using a dot as a field separator.

The syntax above is mustache, which is documented in Elasticsearch core in [search templates](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-template.html#_converting_parameters_to_json). You might also want to check out [the official mustache docs](http://mustache.github.io/mustache.5.html).

If you have more concrete questions, feel free to ask!

--Alex

---

<div class="post-metadata">

### Author: ![chromechris](https://avatars.discourse-cdn.com/v4/letter/c/e47c2d/32.png) [@chromechris](https://discuss.elastic.co/u/chromechris)
#### Post date: [November 14, 2016, 8:33pm UTC](https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471/6 "2016-11-14T20:33:57Z")

</div>

Thanks @spinscale . I will open a new thread next time if the thread I referencing is old to ask questions.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:42pm UTC](https://discuss.elastic.co/t/cant-get-ctx-payload-hits-hits-index-fields-fieldname-to-work/25471/7 "2017-07-06T13:42:08Z")

</div>


