# How to access \_resource in context?

**URL:** <https://discuss.elastic.co/t/how-to-access-resource-in-context/219284>\
**Category:** Kibana\
**Created:** [February 13, 2020, 9:22pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284 "2020-02-13T21:22:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![gunjan\_prmr](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@gunjan\_prmr](https://discuss.elastic.co/u/gunjan_prmr)\
**Post date:** [February 13, 2020, 9:22pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/1 "2020-02-13T21:22:39Z")

</div>

I have set up alert in Kibana for slack notification which works fine. I can access my trigger name by

> {{ ctx.trigger.name }}

I want to access _ **\_source** _ but I don't see that in _ **ctx** _. How can I access that?

[Detailed Info can be found here](https://stackoverflow.com/questions/60214037/how-to-access-specific-log-attributes-in-kibana-alert-using-mustache-js)

{{ ctx }} gives me following:

```
{
  monitor = {
    _id = ,
    _version = 1,
    name = Failed Order Alert - Gunjan,
    enabled = true
  }, trigger = {
    id = JjTeOnABiAzvZMW0wxvs,
    name = Failed Order Trigger,
    severity = 1,
    actions = [{
      name = JUST TESTING
    }]
  }, results = [{
    _shards = {
      total = 75,
      failed = 0,
      successful = 75,
      skipped = 0
    },
    hits = {
      hits = [],
      total = {
        value = 0,
        relation = eq
      },
      max_score = null
    },
    took = 5,
    timed_out = false
  }], periodStart = 2020 - 02 - 12 T21: 52: 50.671 Z, periodEnd = 2020 - 02 - 12 T21: 53: 50.671 Z, alert = null, error = null
}

```

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [February 14, 2020, 2:17pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/2 "2020-02-14T14:17:00Z")

</div>

`_source` will be in each object in `hits.hits` array. `_source` contains the original fields for documents. `hits` contains the search results from an `_search` request. You can find documentation about hits at [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html#search-api-response-body](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-search.html#search-api-response-body)

---

<div class="post-metadata">

**Author:** ![gunjan\_prmr](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@gunjan\_prmr](https://discuss.elastic.co/u/gunjan_prmr)\
**Post date:** [February 14, 2020, 4:18pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/3 "2020-02-14T16:18:20Z")

</div>

> [@gunjan\_prmr](#):
>
> ```auto
> {
> monitor = {
> _id = ,
> _version = 1,
> name = Failed Order Alert - Gunjan,
> enabled = true
> }, trigger = {
> id = JjTeOnABiAzvZMW0wxvs,
> name = Failed Order Trigger,
> severity = 1,
> actions = [{
> name = JUST TESTING
> }]
> }, results = [{
> _shards = {
> total = 75,
> failed = 0,
> successful = 75,
> skipped = 0
> },
> hits = {
> hits = [],
> total = {
> value = 0,
> relation = eq
> },
> max_score = null
> },
> took = 5,
> timed_out = false
> }], periodStart = 2020 - 02 - 12 T21: 52: 50.671 Z, periodEnd = 2020 - 02 - 12 T21: 53: 50.671 Z, alert = null, error = null
> }
> 
> ```

That is what I thought. In that case, why don't I see that in {{ ctx }} object I have pasted above?

---

<div class="post-metadata">

**Author:** ![gunjan\_prmr](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@gunjan\_prmr](https://discuss.elastic.co/u/gunjan_prmr)\
**Post date:** [February 14, 2020, 4:20pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/4 "2020-02-14T16:20:31Z")

</div>

That is what I thought. In that case, why don't I see that in {{ ctx }} object I have pasted above?

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [February 14, 2020, 4:49pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/5 "2020-02-14T16:49:10Z")

</div>

So the hits array is empty? What does your watch query look like? Are you setting `size`?

---

<div class="post-metadata">

**Author:** ![gunjan\_prmr](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@gunjan\_prmr](https://discuss.elastic.co/u/gunjan_prmr)\
**Post date:** [February 14, 2020, 4:51pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/6 "2020-02-14T16:51:34Z")

</div>

![Screen Shot 2020-02-14 at 11.50.39 AM](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c281c8c2ffff3d60ca0b8f88bce1f4b0f04f8ae6.png)

Here is my monitor and the blob I posted in my original question, that is the entire ctx object.

---

<div class="post-metadata">

**Author:** ![gunjan\_prmr](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@gunjan\_prmr](https://discuss.elastic.co/u/gunjan_prmr)\
**Post date:** [February 14, 2020, 6:10pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/7 "2020-02-14T18:10:13Z")

</div>

Here is the query. How can I define `_source` here?  
{  
"size": 0,  
"query": {  
"bool": {  
"filter": [  
{  
"range": {  
"@timestamp": {  
"from": "{{period\_end}}||-30d",  
"to": "{{period\_end}}",  
"include\_lower": true,  
"include\_upper": true,  
"format": "epoch\_millis",  
"boost": 1  
}  
}  
}  
],  
"adjust\_pure\_negative": true,  
"boost": 1  
}  
},  
"aggregations": {}  
}

---

<div class="post-metadata">

**Author:** ![gunjan\_prmr](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@gunjan\_prmr](https://discuss.elastic.co/u/gunjan_prmr)\
**Post date:** [February 21, 2020, 6:03pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/8 "2020-02-21T18:03:31Z")

</div>

I have resolved this. In Kibana logs, when you click on REFRESH button. it makes POST call where you can get the query and tweak it accordingly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2020, 6:03pm UTC](https://discuss.elastic.co/t/how-to-access-resource-in-context/219284/9 "2020-03-20T18:03:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.