Dot in field name for email body


I want to use the field in body of email alert.
field name is "cps-aks.paranoid"

I can access the field using the following syntax - ctx.payload.hits.hits.0._source.cps-aks.paranoid.

Problem is there is a dot in the field "cps-aks.paranoid", due to which I am getting blank in while using moustache template {{ctx.payload.hits.hits.0._source.cps-aks.paranoid}}.

How can I escape the dot in the field name and access the value in email body?


there is no way in mustache to access that field as far as I know. However you could use a transform to change the field names from to foo-bar.

See this simplified example

POST _watcher/watch/_execute
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "10h"
    "input": {
      "simple": {
        "": "bar"
    "actions": {
      "logme": {
        "transform" : {
          "script" : {
            "lang" : "painless",
            "source" : "ctx.payload['foo-bar']=ctx.payload[''] ;  return ctx.payload"
        "logging": {
          "text": "{{}}"

hope this helps!


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.