# Iterate entries in ctx.payload

**URL:** <https://discuss.elastic.co/t/iterate-entries-in-ctx-payload/184337>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 5, 2019, 11:14am UTC](https://discuss.elastic.co/t/iterate-entries-in-ctx-payload/184337 "2019-06-05T11:14:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![muraliv](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@muraliv](https://discuss.elastic.co/u/muraliv)\
**Post date:** [June 5, 2019, 11:14am UTC](https://discuss.elastic.co/t/iterate-entries-in-ctx-payload/184337/1 "2019-06-05T11:14:28Z")

</div>

Hi,

I have the following entries in ctx.payload and the entries are by user id. The first entry is the timestamp and the 2nd entry is the number of times the user failed to login in that bucket.

mydomain\user1=[1559669100000 2, 1559669160000 2, 1559669237000 2, 1559669280000 2, 1559669294000 1, 1559669295000 1],mydomain\user2=[1559669100000 2, 1559669160000 2, 1559669237000 2, 1559669280000 2, 1559669294000 1, 1559669295000 1]

I need help with mapping them into individual fields.

Thanks in advance.

Thanks  
Murali

---

<div class="post-metadata">

**Author:** ![muraliv](https://avatars.discourse-cdn.com/v4/letter/m/f05b48/32.png) [@muraliv](https://discuss.elastic.co/u/muraliv)\
**Post date:** [June 6, 2019, 11:27am UTC](https://discuss.elastic.co/t/iterate-entries-in-ctx-payload/184337/2 "2019-06-06T11:27:56Z")

</div>

Hi All,

I was able to figure it out :-). This is what I did.

"script": "return ['\_doc':ctx.payload.entrySet().stream().flatMap(value -\> value.getValue().stream().map(time\_failedlogin -\> ['@timestamp':time\_failedlogin.substring(0,time\_failedlogin.lastIndexOf(' ')), 'failed\_logins':time\_failedlogin.substring(time\_failedlogin.lastIndexOf(' ')+1), 'alerttype': 'Login Failure', 'username':value.getKey()])).collect(Collectors.toList())];"

Thanks  
Murali

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 4, 2019, 11:27am UTC](https://discuss.elastic.co/t/iterate-entries-in-ctx-payload/184337/3 "2019-07-04T11:27:58Z")

</div>

Closed on July 4, 2019, 11:27am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.