# How to get the ctx.payload.hits.hits after aggregation and transform (Watcher)

**URL:** <https://discuss.elastic.co/t/how-to-get-the-ctx-payload-hits-hits-after-aggregation-and-transform-watcher/249045>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting, painless\
**Created:** [September 18, 2020, 2:04am UTC](https://discuss.elastic.co/t/how-to-get-the-ctx-payload-hits-hits-after-aggregation-and-transform-watcher/249045 "2020-09-18T02:04:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karrie\_Koo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karrie_koo/32/52576_2.png) [@Karrie\_Koo](https://discuss.elastic.co/u/Karrie_Koo)\
**Post date:** [September 18, 2020, 2:04am UTC](https://discuss.elastic.co/t/how-to-get-the-ctx-payload-hits-hits-after-aggregation-and-transform-watcher/249045/1 "2020-09-18T02:04:43Z")

</div>

cannot get {{ctx.payload.hits.hits.0.beats\_state.beat.host}} this field

```
    "subject": "{{ctx.payload.hits.hits.0.beats_state.beat.host}} WARNING: Filebeat is down and unavilable [No. of Filebeat down: {{ctx.payload._value.size}}]",
    "body": {
      "html": "<br><br><ol><li>{{#ctx.payload._value}} <b>Filebeat is down and unavailable in last 15 min:</b>: {{.}} <hr></li> {{/ctx.payload._value}}</ol>"
    }
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 21, 2020, 9:49am UTC](https://discuss.elastic.co/t/how-to-get-the-ctx-payload-hits-hits-after-aggregation-and-transform-watcher/249045/2 "2020-09-21T09:49:46Z")

</div>

Hey,

a fully reproducible example might help a lot here or the output of the [Execute Watch API](https://www.elastic.co/guide/en/elasticsearch/reference/7.8/simulate-pipeline-api.html).

I do have an assumption here, and maybe it is right:

A transform implies, that the data you are returning in your transform will be used as the payload. **Everything else will be lost** - so if you need access to the hits, you need to ensure to include your hits array in the transform as well.

Hope that helps!

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2020, 9:49am UTC](https://discuss.elastic.co/t/how-to-get-the-ctx-payload-hits-hits-after-aggregation-and-transform-watcher/249045/3 "2020-10-19T09:49:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.