Iterate watcher hits and perform action on each hit

Hi, in the example below I have a condition where I send an alert if the first hit contains the query 'some_query'. Is it possible to iterate all hits and sent/stack all hits in an action?

 "condition": {
    "script": {
      "source": "return ctx.payload.hits.hits.0._source.message.contains('some_query')",
      "lang": "painless"
  "actions": {
    "opsgenie": {
      "webhook": {
        "scheme": "https",
        "host": "",
        "port": 443,
        "method": "post",
        "path": "/v1/json/eswatcher",
        "params": {
          "apiKey": "some key"
        "headers": {
          "Content-Type": "application/json"
        "body": "{{#toJson}}ctx.payload.hits.hits.0._source.correlation_id{{/toJson}}"

try something like


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.