# Golang How to parse alerting rule (index connector) document hits

**URL:** <https://discuss.elastic.co/t/golang-how-to-parse-alerting-rule-index-connector-document-hits/278028>\
**Category:** Elastic Observability\
**Created:** [July 7, 2021, 6:52am UTC](https://discuss.elastic.co/t/golang-how-to-parse-alerting-rule-index-connector-document-hits/278028 "2021-07-07T06:52:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bravo](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bravo](https://discuss.elastic.co/u/bravo)\
**Post date:** [July 7, 2021, 6:52am UTC](https://discuss.elastic.co/t/golang-how-to-parse-alerting-rule-index-connector-document-hits/278028/1 "2021-07-07T06:52:36Z")

</div>

In the below sample the alert doument created by the alerting rule, contains 3 documents (json objects) under hits but they are NOT contained in an array , so in Go unable to parse them

Can someone helpme parse the hits documents which comma seperated string of josn objects and are not inside an array

Sample document created by Alert rule type log

```auto
Hits 
[map[_id:2s3kfXoB2vuM1J-EwpE7 _index:alert-X _score:%!s(float64=1) 
	 _source:
	 	map[@timestamp:2021-07-06T22:16:21.818Z 
			action_group:query matched 
			alert_id:query matched 
			alert_name:alert events login 
			hits:
				{"_index":".ds-logs-events-2021.06.30-000005","_type":"_doc","_id":"S83kfXoB2vuM1J-Eo4_v", ... 
				{"_index":".ds-logs-events-2021.06.30-000005","_type":"_doc","_id":"Ss3kfXoB2vuM1J-Eo4_v",...
				{"_index":".ds-logs-events-2021.06.30-000005","_type":"_doc","_id":"N83kfXoB2vuM1J-EiI2l",...
			rule_id:cfb85000-db0e-11eb-83e0-bb11d01642c7 
			rule_name:alert events login
			tags:customer 
			title:alert 'alert events login' matched query 
			value:3
			] 

```

Getting error

```auto
2021/07/07 12:21:19 Error decoding response parse error: expected [ near offset 5818 of '{\"_index\...'
exit status 1

```

Using official go-elasticsearch  
Using easyjson

---

<div class="post-metadata">

**Author:** ![bravo](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bravo](https://discuss.elastic.co/u/bravo)\
**Post date:** [July 10, 2021, 7:21pm UTC](https://discuss.elastic.co/t/golang-how-to-parse-alerting-rule-index-connector-document-hits/278028/2 "2021-07-10T19:21:56Z")

</div>

concatenated document hits with array block and unmarshalled it.

```auto
[
				{"_index":".ds-logs-events-2021.06.30-000005","_type":"_doc","_id":"S83kfXoB2vuM1J-Eo4_v", ... 
				{"_index":".ds-logs-events-2021.06.30-000005","_type":"_doc","_id":"Ss3kfXoB2vuM1J-Eo4_v",...
				{"_index":".ds-logs-events-2021.06.30-000005","_type":"_doc","_id":"N83kfXoB2vuM1J-EiI2l",...
]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:31am UTC](https://discuss.elastic.co/t/golang-how-to-parse-alerting-rule-index-connector-document-hits/278028/3 "2022-11-04T08:31:23Z")

</div>