Recursively Returning Results from a Watch, Newline Output

[MultiplierMultiplier (G T)]

Hi guys,

I have managed to get my watch to output all of the usernames when someone fails to logon, they appear one after the other with a space in between, like so:

"text": "The following user(s) failed to logon: Test Admin TestAdmin User Example

This is the output I am currently using:

 "body": {
          "text": "The following user(s) failed to logon: {{#ctx.payload.hits.hits}} {{_source.target_username}} {{/ctx.payload.hits.hits}}"
        }

I would like the output to look something like:

The following users failed to logon:
                                                               
                                                               Test
                                                               Admin
                                                               TestAdmin
                                                               Example
                                                               User

Or some kind of table format, overall it just needs to be easier to read.

Cheers,

G

[spinscale (Alexander Reelsen)]

Hey,

have you tried something like

{{#ctx.payload.hits.hits}}{{_source.username}}\\n{{/ctx.payload.hits.hits}}

[spinscale (Alexander Reelsen)]

or you could use join with a transform

    "actions": {
      "logging": {
        "transform" : {
          "script" : "return ['usernames' : ctx.payload.hits.hits.stream().map(h -> h._source.username).collect(Collectors.toList()) ]"
        },
        "logging": {
          "text": "{{#join delimiter='\\n'}}ctx.payload.usernames{{/join delimiter='\\n'}}"
        }
      }
    }