# How to pass variable to the body section of script in webhook watcher?

**URL:** <https://discuss.elastic.co/t/how-to-pass-variable-to-the-body-section-of-script-in-webhook-watcher/324118>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting, painless\
**Created:** [January 27, 2023, 3:15pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-to-the-body-section-of-script-in-webhook-watcher/324118 "2023-01-27T15:15:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![M\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_s/32/116340_2.png) [@M\_S](https://discuss.elastic.co/u/M_S)\
**Post date:** [January 27, 2023, 3:15pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-to-the-body-section-of-script-in-webhook-watcher/324118/1 "2023-01-27T15:15:58Z")

</div>

I have the following webhook watcher which creates OTRS ticket when there is a term "Error" in document. However right now the ticket body declared in script is a fixed string for now ( `This is only a test`). How to pass the message body to the script so that when the ticket is created it desplays the actual message of the input?

```auto
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "Error"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "create_otrs": {
      "transform": {
        "script": {
          "source": "return ['Ticket':['Queue':'Engineering Team','Priority':'P3','CustomerUser':'root','Title':'RESTCreateTest','State':'new','Type':'Incident'],'Article':['ContentType':'text/plain;charset=utf8','Subject':'RestCreateTest','Body':'This is only a test']]",
          "lang": "painless"
        }
      },
      "webhook": {
        "scheme": "http",
        "host": "myotrs.com",
        "port": 80,
        "method": "post",
        "path": "/otrs/GenericTicketConnectorREST/User=<User>&Pass=<Password>",
        },
        "headers": {},
        "body": "{{#toJson}}ctx.payload{{/toJson}}"
      }
    }
  }
}

```

One of the example hit is -

```auto
"_index": ".ds-logs-elastic_agent.filebeat-default",
                "_source": {
                  "input_source": "https://ser.example.com:80/export",
                  "agent": {
                    "name": "syslog01",
                    "id": "5836558b-b17d-445e",
                    "type": "filebeat",
                    "ephemeral_id": "36bdfeca-3c60",
                    "version": "8.3.3"
                  },
                  "service.name": "filebeat",
                  "log": {
                    "file": {
                      "path": "/opt/Elastic/Agent/data/elastic-agent-0ffbed/logs/default/filebeat-20230127-12.ndjson"
                    },
                    "offset": 248078415
                  },
                  "elastic_agent": {
                    "id": "5836558b-b17d",
                    "version": "8.3.3",
                    "snapshot": false
                  },
                  "message": """Error while processing http request: failed to execute rf.collectResponse: failed to execute http client.Do: failed to execute http client.Do: Post "https://ser.example.com:80/export": POST https://ser.example.com:80/export giving up after 6 attempts""",
                  "log.logger": "input.httpjson-cursor",
                  "input": {
                    "type": "filestream"
                  },
                  "log.origin": {
                    "file.line": 128,
                    "file.name": "httpjson/input.go"
                  },
                  "@timestamp": "2023-01-27T14:44:42.790Z",
                  "ecs": {
                    "version": "8.0.0"
                  },
                  "data_stream": {
                    "namespace": "default",
                    "type": "logs",
                    "dataset": "elastic_agent.filebeat"
                  },
                  "host": {
                    "hostname": "syslog01",
                    "os": {
                      "kernel": "3.10.25-gentoo",
                      "name": "Gentoo",
                      "type": "linux",
                      "family": "",
                      "version": "",
                      "platform": "gentoo"
                    },
                    "containerized": false,
                  "log.level": "error",
                  "input_url": "https://ser.example.com:8089/export",
                  "id": "httpjson-system.security-ba2ec41b-457b-442a",
                  "event": {
                    "agent_id_status": "verified",
                    "ingested": "2023-01-27T14:44:58Z",
                    "dataset": "elastic_agent.filebeat"
                  }
                },
                "_id": "pCWw84UB8FDLddfs",
                "_score": 2.2840834
              },

```

I want to pass the "message" field of the document into the script in `'Body':'This is only a test'`

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [January 27, 2023, 4:59pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-to-the-body-section-of-script-in-webhook-watcher/324118/2 "2023-01-27T16:59:57Z")

</div>

Just make your `transform` script something like:

```auto
        "transform": {
          "script": """return ['Ticket':['Queue':'EngineeringTeam','Priority':'P3','CustomerUser':'root@localhost','Title':'RESTCreateTest','State':'new','Type':'Incident'],'Article':['ContentType':'text/plain;charset=utf8','Subject':'RestCreateTest','Body':ctx.payload.hits.hits.0._source.message]]"""
        },

```

But, of course, this is the `message` field for only the first (out of possibly many) documents that matched the input query. If you're okay with that....

---

<div class="post-metadata">

**Author:** ![M\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_s/32/116340_2.png) [@M\_S](https://discuss.elastic.co/u/M_S)\
**Post date:** [January 27, 2023, 5:39pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-to-the-body-section-of-script-in-webhook-watcher/324118/3 "2023-01-27T17:39:48Z")

</div>

Thank you so much. Its working fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 24, 2023, 5:40pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-to-the-body-section-of-script-in-webhook-watcher/324118/4 "2023-02-24T17:40:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.