Possible to have {{#context.hits}}{{.}}{{/context/hits}} as array?

Elastic Stack Kibana
1

I am preparing payload for the webhook to be sent when alert is generated by the rule. By using the following mustache template I am able to iterate through several documents get values from them:

{
	"content":  "{{#context.hits}} alert_id: {{{_source.alert_id}}} resource: {{{_source.resource}}} timestamp: {{_source.timestamp}} {{/context.hits}}"
}

However, the returned data is a string value inside of JSON, something like this: Sent Payload:

{
"body" : {
         "content" : " alert_id: f1e1ddc7142c587d51dcaa453ed56ce3 resource: xxxxxx timestamp: 2023-03-15T13:59:13+00:00 alert_id: 1064565be1612303fe53b1cb952c34536 resource: xxxxxxy timestamp: 2023-03-15T13:35:09+00:00
      }
}

Is there anyway to have a line break and return this in something like this:


{
	"body": [{
			"alert_id": "1e1ddc7b49c587d51dcaab34ed56ce3",
			"resource": "xxxxxx",
			"timestamp": "2023-03-15T13:59:13+00:00"
		},
		{
			"alert_id": "106af45be164b03fe53453b952c34536",
			"resource": "xxxxxxy",
			"timestamp": "2023-03-15T13:35:09+00:00"
		}
	]
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.