# I am attempting to pull information from a Watcher query payload to place in an email and I am getting a "index out of bounds exception"

**URL:** <https://discuss.elastic.co/t/i-am-attempting-to-pull-information-from-a-watcher-query-payload-to-place-in-an-email-and-i-am-getting-a-index-out-of-bounds-exception/116540>\
**Category:** Elasticsearch\
**Created:** [January 22, 2018, 9:24pm UTC](https://discuss.elastic.co/t/i-am-attempting-to-pull-information-from-a-watcher-query-payload-to-place-in-an-email-and-i-am-getting-a-index-out-of-bounds-exception/116540 "2018-01-22T21:24:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abshier\_c](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@Abshier\_c](https://discuss.elastic.co/u/Abshier_c)\
**Post date:** [January 22, 2018, 9:24pm UTC](https://discuss.elastic.co/t/i-am-attempting-to-pull-information-from-a-watcher-query-payload-to-place-in-an-email-and-i-am-getting-a-index-out-of-bounds-exception/116540/1 "2018-01-22T21:24:48Z")

</div>

Here is my query and action:

{  
"trigger": {  
"schedule": {  
"interval": "1m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"winlogbeat-\*"  
],  
"types": [],  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"must": {  
"term": {  
"event\_id": "1116"  
}  
},  
"filter": {  
"range": {  
"@timestamp": {  
"from": "now-1m"  
}  
}  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},  
"actions": {  
"send\_email": {  
"email": {  
"profile": "standard",  
"to": [  
"example@company.com"  
],  
"subject": "Threat Detected: {{ctx.payload.hits.hits.0.\_source.computer\_name}}",  
"body": {  
"text": "Windows Defender detected the following threat:"  
}  
}  
}  
}  
}

Here is the execution output for the error:

"actions": [  
{  
"id": "send\_email",  
"type": "email",  
"status": "failure",  
"error": {  
"root\_cause": [  
{  
"type": "general\_script\_exception",  
"reason": "Error running com.github.mustachejava.codes.DefaultMustache@6904158d"  
}  
],  
"type": "general\_script\_exception",  
"reason": "Error running com.github.mustachejava.codes.DefaultMustache@6904158d",  
"caused\_by": {  
"type": "mustache\_exception",  
"reason": "Failed to get value for ctx.payload.hits.hits.0.\_id @[query-template:1]",  
"caused\_by": {  
"type": "mustache\_exception",  
"reason": "0 @[query-template:1]",  
"caused\_by": {  
"type": "index\_out\_of\_bounds\_exception",  
"reason": "0"  
}  
}  
}  
}  
}  
]  
},

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 22, 2018, 9:37pm UTC](https://discuss.elastic.co/t/i-am-attempting-to-pull-information-from-a-watcher-query-payload-to-place-in-an-email-and-i-am-getting-a-index-out-of-bounds-exception/116540/2 "2018-01-22T21:37:09Z")

</div>

your query uses `size: 0`, thus not resulting any JSON sources, but you try to access those in the mustache template, when sending an email, causing this issue.

--Alex

---

<div class="post-metadata">

**Author:** ![Abshier\_c](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@Abshier\_c](https://discuss.elastic.co/u/Abshier_c)\
**Post date:** [January 22, 2018, 10:03pm UTC](https://discuss.elastic.co/t/i-am-attempting-to-pull-information-from-a-watcher-query-payload-to-place-in-an-email-and-i-am-getting-a-index-out-of-bounds-exception/116540/3 "2018-01-22T22:03:51Z")

</div>

Thanks, exactly what i needed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 19, 2018, 10:03pm UTC](https://discuss.elastic.co/t/i-am-attempting-to-pull-information-from-a-watcher-query-payload-to-place-in-an-email-and-i-am-getting-a-index-out-of-bounds-exception/116540/4 "2018-02-19T22:03:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.