How to use {{#context.hits}} alert with an INDEX action?

Hi,

I would like to pass the context.hits information to the index alert connector i have created.

The connector all works, but anything re the context.hits and I get an empty result.

This is one of the many itterations I have tried.

{
  "application": "smartd",
  "severity": "error",
  "errordescription": "triggering data was: {{#context.hits}} - {{_source.host.name}} {{/context.hits}}",
  "@timestamp": "{{context.timestamp}}"
}
1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.