How to read group by buckets key values using "ctx" from below query

{
"_shards": {
"total": 155,
"failed": 0,
"successful": 155,
"skipped": 0
},
"hits": {
"hits": ,
"total": {
"value": 5535,
"relation": "eq"
},
"max_score": null
},
"took": 44,
"timed_out": false,
"aggregations": {
"groupby": {
"buckets": [
{
"doc_count": 4,
"b8d81aba": {
"doc_count": 4
},
"key": {
"4a33222e": "msz_client21"
}
},
{
"doc_count": 14,
"b8d81aba": {
"doc_count": 14
},
"key": {
"4a33222e": "msz_client22"
}
},
{
"doc_count": 5,
"b8d81aba": {
"doc_count": 5
},
"key": {
"4a33222e": "msz_client23"
}
},
{
"doc_count": 5,
"b8d81aba": {
"doc_count": 5
},
"key": {
"4a33222e": "msz_client24"
}
},
{
"doc_count": 5,
"b8d81aba": {
"doc_count": 5
},
"key": {
"4a33222e": "msz_client25"
}
},
{
"doc_count": 8,
"b8d81aba": {
"doc_count": 8
},
"key": {
"4a33222e": "msz_client_staging1"
}
},
{
"doc_count": 29,
"b8d81aba": {
"doc_count": 29
},
"key": {
"4a33222e": "msz_client_staging3"
}
},
{
"doc_count": 11,
"b8d81aba": {
"doc_count": 11
},
"key": {
"4a33222e": "msz_client_staging5"
}
},
{
"doc_count": 3,
"b8d81aba": {
"doc_count": 3
},
"key": {
"4a33222e": "msz_client_staging6"
}
},
{
"doc_count": 60,
"b8d81aba": {
"doc_count": 60
},
"key": {
"4a33222e": "msz_client_staging7"
}
},
{
"doc_count": 36,
"b8d81aba": {
"doc_count": 36
},
"key": {
"4a33222e": "msz_wale"
}
},
{
"doc_count": 96,
"b8d81aba": {
"doc_count": 96
},
"key": {
"4a33222e": "mszstgautousrwith"
}
},
{
"doc_count": 16,
"b8d81aba": {
"doc_count": 16
},
"key": {
"4a33222e": "mszstgtest1"
}
},
{
"doc_count": 1049,
"b8d81aba": {
"doc_count": 1049
},
"key": {
"4a33222e": "walestgtest1"
}
},
{
"doc_count": 1049,
"b8d81aba": {
"doc_count": 1049
},
"key": {
"4a33222e": "walestgtest2"
}
},
{
"doc_count": 1048,
"b8d81aba": {
"doc_count": 1048
},
"key": {
"4a33222e": "walestgtest3"
}
},
{
"doc_count": 1048,
"b8d81aba": {
"doc_count": 1048
},
"key": {
"4a33222e": "walestgtest4"
}
},
{
"doc_count": 1048,
"b8d81aba": {
"doc_count": 1048
},
"key": {
"4a33222e": "walestgtest5"
}
}
],
"after_key": {
"4a33222e": "walestgtest5"
}
}
}
}

I am reading as below but it is not working

{{ctx.payload.aggregations.groupby.buckets.key}}

ctx is used in script to access some fields,I'm not sure what you mean,use ctx to read response?

actually my requirement is :slight_smile:

i am creating few alarms in kibana and i would like to show response data in email body , whenever this alert trigger , and i am trying to add response data using ctx , is there any other way to add this to email in kibana alarm trigger action ?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.