How to print all the hits from a bucket array of results

Elastic Stack Elasticsearch
1

I am using Watcher/Alerts to send some emails but it dont seem to find out how to get all keys from an array with out all the array:

{{ctx.payload.aggregations.host.buckets.*.key}}

<-- this is what my logic said it should work but it didnt :smiley:

"host" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"doc_count" : 3,
"key" : "someservername-02.com"
},
{
"doc_count" : 3,
"key" : "someservername-03.com"
}
]
},

I have to specify each but i am not sure how to find out how many to iterate but i ithink iterations are not possible here so is there a way just to print the keys? i want to avoid the doc_count?

i know this works

{{ctx.payload.aggregations.host.buckets}}

but can i just filter a specific field?

I tried adding a bunch of

{{ctx.payload.aggregations.host.buckets.1.key}} {{ctx.payload.aggregations.host.buckets.2.key}} {{ctx.payload.aggregations.host.buckets.3.key}}

but ill get an out of index array because there isnt 3 every time.

2

Hey,

try looping like this

{{#ctx.payload.aggregations.host.buckets}}
{{key}}
{{/ctx.payload.aggregations.host.buckets}}
3

Thanks, i think i found this in another post from you and i wonder if its possible to go a bit higher on the object for example:

{{#ctx.payload.aggregations}}
{{host.buckets.key}}
{{/ctx.payload.aggregations}}

This didnt work for me, the idea is to collect diffent subobjects while i am looping.

or what about

{{#ctx.payload.hits.hits}}
{{host.buckets.key}}
{{/ctx.payload.hits.hits}}

i dont seem to find a way to loop like that.

4

that looping only works on lists. ctx.payload.aggregations is not a list.

ctx.payload.hits.hits is a list and you can then access the elements within like {{_source.foo}} or {{_index}}. You can only access fields within that single list element.

5

Thanks :slight_smile: