Parse context_hits

Elastic Stack Kibana
1

I've create a rule whose connector is write to index. I wonder if possible to parse context_hits to create an additional field when hit the rule.

Screenshot 2022-12-15 at 12.43.15

For example I would like to create an additional field called message only containing subfield messages from dictionary {{context_hits }}

Thanks

2

I spotted how to achieve that.

putting in the document to index the following field:

"host": "{{context.hits.0._source.host_name}}"

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.