# Extract certain watcher fields

**URL:** https://discuss.elastic.co/t/extract-certain-watcher-fields/227751
**Category:** Kibana
**Created:** [April 13, 2020, 9:41am UTC](https://discuss.elastic.co/t/extract-certain-watcher-fields/227751 "2020-04-13T09:41:24Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)
#### Post date: [April 13, 2020, 9:41am UTC](https://discuss.elastic.co/t/extract-certain-watcher-fields/227751/1 "2020-04-13T09:41:24Z")

</div>

Hello,

In this elastic search link: [https://www.elastic.co/guide/en/watcher/2.3/input.html#input-search](https://www.elastic.co/guide/en/watcher/2.3/input.html#input-search) it specifies how to get a field value from a particular hit and it provides an example if we want to get the value of message field from the first hit (see image below).

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/6/06266c0b04ea3767129062b03b02eed35d5d5750.png)

That is clear. Nevertheless if i do not want the message field only from the first hit but i want the message field from all hits what should i enter instead of 0 ??? (see image again number 2)

Thank you

---

<div class="post-metadata">

### Author: ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [April 13, 2020, 4:39pm UTC](https://discuss.elastic.co/t/extract-certain-watcher-fields/227751/2 "2020-04-13T16:39:12Z")

</div>

@spinscale can shed some light here when he gets a chance to see this.

Thanks  
Rashmi

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [April 15, 2020, 12:52pm UTC](https://discuss.elastic.co/t/extract-certain-watcher-fields/227751/3 "2020-04-15T12:52:16Z")

</div>

I suppose you're talking about accessing this field in a condition. You can loop through the results doing something like

```auto
for (int i = 0; i < ctx.payload.hits.hits.size() ; i++) { 
  def message = ctx.payload.hits.hits[i]._source.message;
  // check something here...
}

```

this was on top of my head and untested, but I hope you get the idea.

---

<div class="post-metadata">

### Author: ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)
#### Post date: [April 15, 2020, 3:20pm UTC](https://discuss.elastic.co/t/extract-certain-watcher-fields/227751/4 "2020-04-15T15:20:14Z")

</div>

Hello Alexander,

Thank you for your response. What i want to do is described in more detail in an another ticket of mine which can be traced here: [Make the email body of my alert easier to read](https://discuss.elastic.co/t/make-the-email-body-of-my-alert-easier-to-read/224773/5) .If you can provide a possible solution there it would be perfect.

Thank you

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 13, 2020, 3:29pm UTC](https://discuss.elastic.co/t/extract-certain-watcher-fields/227751/5 "2020-05-13T15:29:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
