How to access _resource in context?

I have set up alert in Kibana for slack notification which works fine. I can access my trigger name by

{{ ctx.trigger.name }}

I want to access _source but I don't see that in ctx. How can I access that?

Detailed Info can be found here

{{ ctx }} gives me following:

{
  monitor = {
    _id = ,
    _version = 1,
    name = Failed Order Alert - Gunjan,
    enabled = true
  }, trigger = {
    id = JjTeOnABiAzvZMW0wxvs,
    name = Failed Order Trigger,
    severity = 1,
    actions = [{
      name = JUST TESTING
    }]
  }, results = [{
    _shards = {
      total = 75,
      failed = 0,
      successful = 75,
      skipped = 0
    },
    hits = {
      hits = [],
      total = {
        value = 0,
        relation = eq
      },
      max_score = null
    },
    took = 5,
    timed_out = false
  }], periodStart = 2020 - 02 - 12 T21: 52: 50.671 Z, periodEnd = 2020 - 02 - 12 T21: 53: 50.671 Z, alert = null, error = null
}

_source will be in each object in hits.hits array. _source contains the original fields for documents. hits contains the search results from an _search request. You can find documentation about hits at https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html#search-api-response-body

That is what I thought. In that case, why don't I see that in {{ ctx }} object I have pasted above?

That is what I thought. In that case, why don't I see that in {{ ctx }} object I have pasted above?

So the hits array is empty? What does your watch query look like? Are you setting size?

Here is my monitor and the blob I posted in my original question, that is the entire ctx object.

Here is the query. How can I define _source here?
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"from": "{{period_end}}||-30d",
"to": "{{period_end}}",
"include_lower": true,
"include_upper": true,
"format": "epoch_millis",
"boost": 1
}
}
}
],
"adjust_pure_negative": true,
"boost": 1
}
},
"aggregations": {}
}

I have resolved this. In Kibana logs, when you click on REFRESH button. it makes POST call where you can get the query and tweak it accordingly.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.