I am attempting to include all fields from my search query results in an watcher email, currently I can only see what I am matching directly in my query.
{
"trigger": {
"schedule": {
"interval": "90s"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"wazuh-alerts-3.x-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 1000,
"query": {
"bool": {
"must": [
{
"match": {
"syscheck.tags": "1234"
}
},
{
"range": {
"timestamp": {
"gte": "now-90s",
"lte": "now"
}
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"attachments": {
"attached_data": {
"data": {
"format": "json"
}
}
},
"priority": "high",
"to": [
"yellow@gmail.com"
],
"subject": "Arbitrary Email Subject ",
"body": {
"text": "See attached JSON file for details"
}
}
}
}
}