# How to get the value of an array using ctx.payload

**URL:** <https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864>\
**Category:** Elasticsearch\
**Created:** [October 15, 2021, 5:09pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864 "2021-10-15T17:09:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![StephaneRodier](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@StephaneRodier](https://discuss.elastic.co/u/StephaneRodier)\
**Post date:** [October 15, 2021, 5:09pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864/1 "2021-10-15T17:09:59Z")

</div>

Hello,

Let's say I have the results below in an array of 2:

```auto
        "hits": {
          "hits": [
            {
              "_index": "blah-2021.10.01-000003",
              "_type": "_doc",
              "_source": {
                "log.message": "blah blah",
                "log.syslog.severity.code": "1",
                "log.syslog.priority.code": "129",
                "log.syslog.appname": "MS_SI",
                "log.hostname": "xxx",
                "host.hostname": "yyy",
                "process.pid": "5619",
                "host.type": "xxx",
                "log.syslog.tag": "MS_SI[5619]",
                "log.syslog.facility.name": "local0",
                "@timestamp": "2021-10-05T16:30:35.982Z",
                "log.syslog.structured-data": "-",
                "@version": "1",
                "source.ip": "1.1.1.1",
                "log.syslog.severity.name": "alert",
                "log.code": "0X50000000",
                "log.syslog.priority.name": "local0.alert",
                "log.original": "blah blah 2",
                "log.syslog.facility.code": "16",
                "log.syslog.version": "1"
              },
              "_id": "fSC_VnwBcyUX2n9Drmuo",
              "_score": 21.817675
            },
            {
              "_index": "blah-2021.10.01-000003",
              "_type": "_doc",
              "_source": {
                "log.message": "blah blah",
                "log.syslog.severity.code": "1",
                "log.syslog.priority.code": "129",
                "log.syslog.appname": "MS_SI",
                "log.hostname": "xxxx",
                "host.hostname": "xxxx",
                "process.pid": "5619",
                "host.type": "xxx",
                "log.syslog.tag": "MS_SI[5619]",
                "log.syslog.facility.name": "local0",
                "@timestamp": "2021-10-07T05:00:07.890Z",
                "log.syslog.structured-data": "-",
                "@version": "1",
                "source.ip": "2.2.2.2",
                "log.syslog.severity.name": "alert",
                "log.code": "0X50000000",
                "log.syslog.priority.name": "local0.alert",
                "log.original": "blah blah 2",
                "log.syslog.facility.code": "16",
                "log.syslog.version": "1"
              },
              "_id": "EisfWXwBBYtMJzigfHlV",
              "_score": 21.817675
            },
		]

```

I am able to extract the \_source, but nothing under \_source. For example, if I want this specific field: log.hostname, what would I need to do?

Example:  
with

> ctx.payload.hits.hits.0.\_source

I can get the first ID in the array

> {log.message=blah blah, log.syslog.severity.code=1, log.syslog.priority.code=129, log.syslog.appname=MS\_SI, log.hostname=xxx, host.hostname=yyy, process.pid=5619, host.type=xxx, log.syslog.tag=MS\_SI[5619], log.syslog.facility.name=local0, @timestamp=2021-10-07T05:24:47.870Z, log.syslog.structured-data=-, @version=1, source.ip=1.1.1.1, log.syslog.severity.name=alert, log.code=0X50000000, log.syslog.priority.name=local0.alert, log.original=blah blah 2, log.syslog.facility.code=16, log.syslog.version=1}.

But this returns nothing:

> ctx.payload.hits.hits.0.\_source.log.hostname

---

<div class="post-metadata">

**Author:** ![StephaneRodier](https://avatars.discourse-cdn.com/v4/letter/s/ed8c4c/32.png) [@StephaneRodier](https://discuss.elastic.co/u/StephaneRodier)\
**Post date:** [October 15, 2021, 8:19pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864/2 "2021-10-15T20:19:27Z")

</div>

Hello, I just found in another topic that Mustache does not like "." in the variables and a transformation is required as described below

> [@Unable to access payload \_source fields using Watcher foreach with rollup data](https://discuss.elastic.co/t/unable-to-access-payload-source-fields-using-watcher-foreach-with-rollup-data/221049/2):
>
> I resolved the issue. Mustache is not able to access fields with a dot inside them. I added a transform action, where I changed the field name, and then logged it out. "transform": { "script": { "lang" : "painless", "inline": "ctx.payload.hits.hits.forEach(hit -\> hit.\_source.service\_name\_terms\_count = hit.\_source['service.name.terms.\_count']); return ctx.payload" } } "text": "Found ##{{ctx.payload.\_id}}## at ##{{ctx.payload.\_source.service\_name\_terms\_count}}##"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2021, 8:19pm UTC](https://discuss.elastic.co/t/how-to-get-the-value-of-an-array-using-ctx-payload/286864/3 "2021-11-12T20:19:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.