==================Index output====================================
{
"took": 590,
"timed_out": false,
"_shards": {
"total": 10,
"successful": 9,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 182288644,
"max_score": 1,
"hits": [
{
"_index": "logstash-ossec-2018.05.02",
"_type": "doc",
"_id": "iD9CHmMBSutjJDB7Oh9L",
"_score": 1,
"_source": {
"rule": {
"description": "Windows Logon Success.",
"firedtimes": 40368,
"pci_dss": [
"10.2.5"
],
"mail": false,
"id": "18107",
"level": 3,
"groups": [
"windows",
"authentication_success"
]
},
===============================================================
======================Watch===================================
{
"trigger": {
"schedule": {
"interval": "5s"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-ossec-*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"should": [
{
"match_phrase": {
"rule.description": "sshd: Attempt to login using a nodn-existent user"
}
},
{
"match_phrase": {
"rule.description": "Windows: Logon Failure - Unknown user or bad password"
}
}
],
"minimum_should_match": 1,
"filter": {
"range": {
"@timestamp": {
"gte": "now-7d"
}
}
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"my-logging-action": {
"logging": {
"level": "info",
"text": "There are {{ctx.payload.hits.hits._source.description}} Attempts in last 10 Minutes."
}
}
}
}
====================actions output==============================
"actions": [
{
"id": "my-logging-action",
"type": "logging",
"status": "success",
"logging": {
"logged_text": "There are Attempts in last 10 Minutes."
}
}
]
},
"messages": []
}
I want to print Description field value which i am not able to ... please help.