How to get the ctx.payload.hits.hits after aggregation and transform (Watcher)

[Karrie_Koo]

cannot get {{ctx.payload.hits.hits.0.beats_state.beat.host}} this field

    "subject": "{{ctx.payload.hits.hits.0.beats_state.beat.host}} WARNING:  Filebeat is down and unavilable [No. of Filebeat down: {{ctx.payload._value.size}}]",
    "body": {
      "html": "<br><br><ol><li>{{#ctx.payload._value}} <b>Filebeat is down and unavailable in last 15 min:</b>: {{.}} <hr></li> {{/ctx.payload._value}}</ol>"
    }

[spinscale (Alexander Reelsen)]

Hey,

a fully reproducible example might help a lot here or the output of the Execute Watch API.

I do have an assumption here, and maybe it is right:

A transform implies, that the data you are returning in your transform will be used as the payload. Everything else will be lost - so if you need access to the hits, you need to ensure to include your hits array in the transform as well.

Hope that helps!

--Alex