# How specify groupby value in a observability rule

**URL:** https://discuss.elastic.co/t/how-specify-groupby-value-in-a-observability-rule/378358
**Category:** Elastic Observability
**Created:** [May 20, 2025, 7:54pm UTC](https://discuss.elastic.co/t/how-specify-groupby-value-in-a-observability-rule/378358 "2025-05-20T19:54:33Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jfsardon](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@jfsardon](https://discuss.elastic.co/u/jfsardon)
#### Post date: [May 20, 2025, 7:54pm UTC](https://discuss.elastic.co/t/how-specify-groupby-value-in-a-observability-rule/378358/1 "2025-05-20T19:54:34Z")

</div>

Hi all,  
I've a simple rule with two groupby fields (Client, hostname) to trig a an alert for each (Client, hostname)

I created an index action ==\> I just want th set target index fields with the two groupby values  
but... doesn't work : the 2 fields are empty.  
I think I do not use the right syntax to access groupby value : {{context.group.Client}} and {{context.group.hostname}}

Any idea ?

```auto
PUT kbn:/api/alerting/rule/140985cd-b567-4a3b-83b5-67478d7e6115
{
  "name": "NABLE - server - Disk%",
  "tags": [
    "easyServer"
  ],
  "schedule": {
    "interval": "15m"
  },
  "params": {
    "criteria": [
      {
        "comparator": ">",
        "metrics": [
          {
            "name": "A",
            "aggType": "count"
          }
        ],
        "threshold": [
          0
        ],
        "timeSize": 1,
        "timeUnit": "h"
      }
    ],
    "alertOnNoData": false,
    "alertOnGroupDisappear": false,
    "searchConfiguration": {
      "query": {
        "query": "category :\"easyServer\" and serviceName :\"Disk\" and notificationState :\"Failed\" ",
        "language": "kuery"
      },
      "index": "051856ce-a499-4db3-b676-ca8c1c5885dd"
    },
    "groupBy": [
      "Client",
      "hostname"
    ]
  },
  "actions": [
    {
      "group": "custom_threshold.fired",
      "id": "elastic-cloud-email",
      "params": {
        "message": "Reason : {{context.reason}}\nActionGroup : {{alert.actionGroup}}\nActionGroupName : {{alert.actionGroupName}}\nAlertConsecutiveMatch : {{alert.consecutiveMatches}}\n\nContext.alertetailUrl : ({{context.alertDetailsUrl}})\n",
        "to": [
          "xxxx@tttt.fr"
        ],
        "subject": "alerte_elk Pack easyServer - Alerte Disque sur {{context.group.hostname}} "
      },
      "frequency": {
        "notify_when": "onActionGroupChange",
        "throttle": null,
        "summary": false
      },
      "uuid": "e3a4937d-6658-4403-96f9-c33ffb12ff95"
    },
    {
      "group": "custom_threshold.fired",
      "id": "d7dc0561-77a5-49a7-b844-4b3817450cb3",
      "params": {
        "documents": [
          {
            "offre": "easyServer",
            "alertName": "DiskUsage",
            "alertData": "",
            "alertLevel": "Error",
            "customer": "{{context.group.Client}}",
            "hostname": "{{context.group.hostname}}",
            "alertProvider": "nable"
          }
        ]
      },
      "frequency": {
        "notify_when": "onActiveAlert",
        "throttle": null,
        "summary": false
      },
      "uuid": "6fcda818-e583-434f-a7eb-a8f3777ce264"
    }
  ]
}

```

---

<div class="post-metadata">

### Author: ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [May 21, 2025, 4:31am UTC](https://discuss.elastic.co/t/how-specify-groupby-value-in-a-observability-rule/378358/2 "2025-05-21T04:31:42Z")

</div>

Hello @jfsardon :

We can access it by context.group.0.value , context.group.1.value  
When in doubt try to just return {{context}} this will give the complete output & then it will be easy to understand as to how we can fetch the data we need from this {{context}}. I generally use this method.

Thanks!!

---

<div class="post-metadata">

### Author: ![jfsardon](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@jfsardon](https://discuss.elastic.co/u/jfsardon)
#### Post date: [May 21, 2025, 9:13am UTC](https://discuss.elastic.co/t/how-specify-groupby-value-in-a-observability-rule/378358/3 "2025-05-21T09:13:54Z")

</div>

Merci beaucoup !