Extract certain watcher fields


In this elastic search link: https://www.elastic.co/guide/en/watcher/2.3/input.html#input-search it specifies how to get a field value from a particular hit and it provides an example if we want to get the value of message field from the first hit (see image below).

That is clear. Nevertheless if i do not want the message field only from the first hit but i want the message field from all hits what should i enter instead of 0 ??? (see image again number 2)

Thank you

@spinscale can shed some light here when he gets a chance to see this.


I suppose you're talking about accessing this field in a condition. You can loop through the results doing something like

for (int i = 0; i < ctx.payload.hits.hits.size() ; i++) { 
  def message = ctx.payload.hits.hits[i]._source.message;
  // check something here...

this was on top of my head and untested, but I hope you get the idea.

Hello Alexander,

Thank you for your response. What i want to do is described in more detail in an another ticket of mine which can be traced here: Make the email body of my alert easier to read .If you can provide a possible solution there it would be perfect.

Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.