# How to include the ctx.payload.value in the email text for watcher alert?

**URL:** <https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [April 9, 2021, 4:19am UTC](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655 "2021-04-09T04:19:49Z")\
**Posts on this page:** 5\
**Page:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 26, 2021, 5:30am UTC](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655/21 "2021-04-26T05:30:32Z")

</div>

Hi @Patr123

Going back to your very first post where you were so close why did you not put the same transform script that you have in the log action into the email action as well? Seems like it is missing since it is inside the action context I don't think those value atr available for the email action.

You can see in the output of your simulate that those values are there for the log action but not for the email action so try putting that transform script in the email action as well.

```
"transform": {
                "script": {
                    "source": "def last_period=ctx.payload.aggregations.periods.buckets.last_period.hosts.buckets.stream().map(e -> e.key).collect(Collectors.toList()); return ctx.payload.aggregations.periods.buckets.history.hosts.buckets.stream().map(e -> e.key).filter(p -> !last_period.contains(p)).collect(Collectors.toList());",
                    "lang": "painless"
                }
            },

```

If that works then perhaps you can pull it out side as a transform although that will overwrite the entire payload. Which is what I explained in the other thread.

If you put it at the bottom outside the actions it should be available for both actions see [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-script.html). But be careful as it over writes the existing payload. The other thread showed how to do that.

---

<div class="post-metadata">

**Author:** ![Patr123](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@Patr123](https://discuss.elastic.co/u/Patr123)\
**Post date:** [April 26, 2021, 3:34pm UTC](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655/22 "2021-04-26T15:34:13Z")

</div>

After the change my action block looks like:

```auto
"actions": {
    "log": {
      "transform": {
        "script": {
          "source": "def last_period=ctx.payload.aggregations.periods.buckets.last_period.hosts.buckets.stream().map(e -> e.key).collect(Collectors.toList()); return ctx.payload.aggregations.periods.buckets.history.hosts.buckets.stream().map(e -> e.key).filter(p -> !last_period.contains(p)).collect(Collectors.toList());",
          "lang": "painless"
        }
      },
      "logging": {
        "level": "info",
        "text": "Systems not responding in the last {{ctx.metadata.last_period}} minutes:{{#ctx.payload._value}}{{.}}:{{/ctx.payload._value}}"
      }
    },
    "email_administrator": {
            "email": {
			"transform": {
                "script": {
                    "source": "def last_period=ctx.payload.aggregations.periods.buckets.last_period.hosts.buckets.stream().map(e -> e.key).collect(Collectors.toList()); return ctx.payload.aggregations.periods.buckets.history.hosts.buckets.stream().map(e -> e.key).filter(p -> !last_period.contains(p)).collect(Collectors.toList());",
                    "lang": "painless"
                }
            },
                "profile": "standard",
                "attachments": {
                    "attached_data": {
                        "data": {
                            "format": "json"
                        }
                    }
                },
                "from": "abc@xyx.com",
                "to": [
                    "test123@xyz.com"
                ],
                "subject": "Encountered {{ctx.payload.hits.total}} Metricbeat Agents not reporting in last 35 mins",
                "body": {
                    "text": "{{#ctx.payload._value}}{{.}}:{{/ctx.payload._value}}"
                }
            }
        }
    },

```

And I get cannot simulate watch error.

 ![Simulation_error](https://us1.discourse-cdn.com/elastic/original/3X/1/d/1de5bd848814af5ac04cc7dad29e8cc1facf04f9.jpeg)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 26, 2021, 3:40pm UTC](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655/23 "2021-04-26T15:40:36Z")

</div>

So I would try to take that script out of each of the the actions and put it at the bottom of the watcher right after the list of actions then it should be available for both the actions, which I think would be a better approach.

See how we did it [here](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/45)

Also it look like you put the transform in the wrong place in the email it should have gone right after this line I think

```auto
    "email_administrator": {
         <! --- Here 

```

That said I think doing what I said above (extract and make common) is a better approach in fact I am not even sure if you can transform the payload more than once.

---

<div class="post-metadata">

**Author:** ![Patr123](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@Patr123](https://discuss.elastic.co/u/Patr123)\
**Post date:** [April 26, 2021, 4:07pm UTC](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655/24 "2021-04-26T16:07:21Z")

</div>

Thank you so much. That did the trick. I added the transform script right after `"email_administrator": {` part and it worked.  
I also tried the first approach which you mentioned and added the transform script at the end of the actions list and that worked too.  
Thank you again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2021, 4:08pm UTC](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655/25 "2021-05-24T16:08:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/how-to-include-the-ctx-payload-value-in-the-email-text-for-watcher-alert/269655.md?page=1)