# How to return results with ctx.payload
**URL:** https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768
**Category:** Kibana
**Tags:** elastic-stack-alerting, painless
**Created:** [October 30, 2020, 2:11am UTC](https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768 "2020-10-30T02:11:08Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@johno79](https://discuss.elastic.co/u/johno79)
#### Post date: [October 30, 2020, 2:11am UTC](https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768/1 "2020-10-30T02:11:08Z")
While creating a Kibana Alert and Trigger I have the following results from an extraction query response...and wondering how to properly use ctx.payload in the message(sending via webhook in slack) to return the Hospital results below..
Currently the message carries...and of course the Results section fails to return anything...
Thanks...
Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.
- Trigger: {{ctx.trigger.name}}
- Severity: {{ctx.trigger.severity}}
- Period start: {{ctx.periodStart}}
- Period end: {{ctx.periodEnd}}
- Results: {{/ctx.payload}}
//Code begins below
```auto
{
"_shards": {
"total": 1,
"failed": 0,
"successful": 1,
"skipped": 0
},
"hits": {
"hits": [],
"total": {
"value": 27,
"relation": "eq"
},
"max_score": null
},
"took": 2,
"timed_out": false,
"aggregations": {
"2": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"value": 1332
},
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 11,
"buckets": [
{
"1": {
"value": 249
},
"doc_count": 5,
"key": "PRISMA HEALTH PATEWOOD HOSPITAL"
},
{
"1": {
"value": 245
},
"doc_count": 5,
"key": "PRISMA HEALTH GREER MEMORIAL HOSPITAL"
},
{
"1": {
"value": 99
},
"doc_count": 2,
"key": "MUSC HEALTH FLORENCE MEDICAL CENTER"
},
{
"1": {
"value": 98
},
"doc_count": 2,
"key": "ANMED HEALTH"
},
{
"1": {
"value": 98
},
"doc_count": 2,
"key": "PIEDMONT MEDICAL CENTER"
}
]
},
"doc_count": 27,
"key": "hospital"
}
]
}
}
}
```
//
---
### Author:  [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [November 2, 2020, 1:26pm UTC](https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768/2 "2020-11-02T13:26:53Z")
Are you using [watcher](https://www.elastic.co/guide/en/kibana/current/watcher-ui.html) or Kibana's new [alerts and actions](https://www.elastic.co/guide/en/kibana/current/alerting-getting-started.html)?
Can you provide more context about what you are trying to do?
---
### Author:  [@johno79](https://discuss.elastic.co/u/johno79)
#### Post date: [November 3, 2020, 5:43pm UTC](https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768/3 "2020-11-03T17:43:33Z")
Yes thanks for asking. Using Alerts and Actions..so I know I can get a visualization to return the five top hospitals but was trying to use the trigger to send the results via my current Webhook..
I used a trigger that returned ( and yes it says top10..working on top5 first 🙂 )
_Monitor JohnO-top10Infections\_mod1 just entered alert status. Please investigate the issue._
_- Trigger: Top Hospitals\_MOD Test_
_- Severity: 3_
_- Period start: 2020-11-03T17:40:31Z_
_- Period end: 2020-11-03T17:41:31Z_
_- Results_:
does that help?
---
### Author:  [@johno79](https://discuss.elastic.co/u/johno79)
#### Post date: [November 3, 2020, 8:23pm UTC](https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768/4 "2020-11-03T20:23:50Z")
And I just realized it is mustache so I changed to
_Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue._
_- Trigger: {{ctx.trigger.name}}_
_- Severity: {{ctx.trigger.severity}}_
_- Period start: {{ctx.periodStart}}_
_- Period end: {{ctx.periodEnd}}_
_- Results: {{ctx.results}}_
and now get sent
_Monitor JohnO-top10Infections\_mod1 just entered alert status. Please investigate the issue._
_- Trigger: Top Hospitals\_MOD Test_
_- Severity: 3_
_- Period start: 2020-11-03T20:18:15.821Z_
_- Period end: 2020-11-03T20:19:15.821Z_
_- Results: {0={\_shards={total=1, failed=0, successful=1, skipped=0}, hits={hits=[], total={value=10000, relation=gte}, max\_score=null}, took=1, timed\_out=false, aggregations={hospital={doc\_count\_error\_upper\_bound=0, sum\_other\_doc\_count=0, buckets=[{1={value=171331.0}, doc\_count=18988, 3={doc\_count\_error\_upper\_bound=-1, sum\_other\_doc\_count=18833, buckets=[{1={value=20301.0}, doc\_count=31, key=UNIVERSITY OF MD BALTIMORE WASHINGTON MEDICAL CENTER}, {1={value=11617.0}, doc\_count=31, key=MEDSTAR SAINT MARY'S HOSPITAL}, {1={value=9585.0}, doc\_count=31, key=HOWARD COUNTY GENERAL HOSPITAL}, {1={value=7980.0}, doc\_count=31, key=UNION HOSPITAL OF CECIL COUNTY}, {1={value=7797.0}, doc\_count=31, key=FREDERICK HEALTH HOSPITAL}]}, key=hospital}]}}}}_
So now I need to just, I assume, work through a loop?
---
### Author:  [@gmmorris](https://discuss.elastic.co/u/gmmorris)
#### Post date: [November 3, 2020, 9:47pm UTC](https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768/5 "2020-11-03T21:47:56Z")
Hi @johno79,
Welcome to the Elastic community 🙂
I'm sorry to say that looking at your configuration above I believe you're not in fact using Kibana's Alerting framework, but rather Amazon's OpenDistro for Elasticsearch.
This is not the Elastic distribution of Kibana, but rather an Amazon specific product ([see the differences here](https://www.elastic.co/aws-elasticsearch-service)). We unfortunately cannot offer support for Amazon's distribution, so you may have better luck asking in their forums.
It's also worth noting that we do have an alerting feature as part of our distribution as well, which we are happy to offer support for: [https://www.elastic.co/what-is/kibana-alerting](https://www.elastic.co/what-is/kibana-alerting)
---
### Author:  [@johno79](https://discuss.elastic.co/u/johno79)
#### Post date: [November 4, 2020, 1:38am UTC](https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768/6 "2020-11-04T01:38:55Z")
Good point...we do run ELK and open distro...and you are right...our Production is ELK but I am doing this is dev so that may be open distro..
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 2, 2020, 1:38am UTC](https://discuss.elastic.co/t/how-to-return-results-with-ctx-payload/253768/7 "2020-12-02T01:38:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.