Parse context_hits

I've create a rule whose connector is write to index. I wonder if possible to parse context_hits to create an additional field when hit the rule.

Screenshot 2022-12-15 at 12.43.15

For example I would like to create an additional field called message only containing subfield messages from dictionary {{context_hits }}


I spotted how to achieve that.

putting in the document to index the following field:

"host": "{{context.hits.0._source.host_name}}"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.