Extract certain watcher fields

[Alexandros888]

Hello,

In this elastic search link: https://www.elastic.co/guide/en/watcher/2.3/input.html#input-search it specifies how to get a field value from a particular hit and it provides an example if we want to get the value of message field from the first hit (see image below).

That is clear. Nevertheless if i do not want the message field only from the first hit but i want the message field from all hits what should i enter instead of 0 ??? (see image again number 2)

Thank you

[rashmi (kulkarni)]

@spinscale can shed some light here when he gets a chance to see this.

Thanks
Rashmi

[spinscale (Alexander Reelsen)]

I suppose you're talking about accessing this field in a condition. You can loop through the results doing something like

for (int i = 0; i < ctx.payload.hits.hits.size() ; i++) { 
  def message = ctx.payload.hits.hits[i]._source.message;
  // check something here...
}

this was on top of my head and untested, but I hope you get the idea.

[Alexandros888]

Hello Alexander,

Thank you for your response. What i want to do is described in more detail in an another ticket of mine which can be traced here: Make the email body of my alert easier to read .If you can provide a possible solution there it would be perfect.

Thank you