cannot get {{ctx.payload.hits.hits.0.beats_state.beat.host}} this field
"subject": "{{ctx.payload.hits.hits.0.beats_state.beat.host}} WARNING: Filebeat is down and unavilable [No. of Filebeat down: {{ctx.payload._value.size}}]",
"body": {
"html": "<br><br><ol><li>{{#ctx.payload._value}} <b>Filebeat is down and unavailable in last 15 min:</b>: {{.}} <hr></li> {{/ctx.payload._value}}</ol>"
}
a fully reproducible example might help a lot here or the output of the Execute Watch API.
I do have an assumption here, and maybe it is right:
A transform implies, that the data you are returning in your transform will be used as the payload. Everything else will be lost - so if you need access to the hits, you need to ensure to include your hits array in the transform as well.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.