Please see: https://github.com/elastic/examples/blob/master/Alerting/Sample%20Watches/filesystem_usage/watch.json
"actions": {
"log": {
"logging": {
"text": {
"inline": "Some hosts are over {{ctx.payload.threshold}}% utilized:{{#ctx.payload.hosts}}{{disk_usage}}%-{{key}}:{{/ctx.payload.hosts}}"
}
}
}
}