Can't get document message fields printed in my alerts using ctx


I am trying to setup my trigger to send message to slack and embed some fields from documents sampled by my monitor.

I am using Opendistro 7.4.0 in AWS.

I only managed to reference the total hits though using the following:

Monitor {{}} just entered alert status. Please investigate the issue.
- Trigger: {{}}
- Severity: {{ctx.trigger.severity}}
- Period start: {{ctx.periodStart}}
- Period end: {{ctx.periodEnd}}

Total hits: {{#ctx.results}}{{#hits}}{{total}}{{/hits}}{{/ctx.results}}

Severity: 1

  • Period start: 2020-07-24T12:35:09.949Z
  • Period end: 2020-07-24T12:36:09.949Z
    Total hits: {value=2, relation=eq}

How do I reference fields in my message like the following?

Hi @danona45,

I'd recommend to open an issue at Opendistro forum:


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.