# Return JSON array of objects via webhook and script transform

**URL:** <https://discuss.elastic.co/t/return-json-array-of-objects-via-webhook-and-script-transform/266030>\
**Category:** Elasticsearch\
**Created:** [March 2, 2021, 11:18pm UTC](https://discuss.elastic.co/t/return-json-array-of-objects-via-webhook-and-script-transform/266030 "2021-03-02T23:18:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![gabriel.ratcliff](https://avatars.discourse-cdn.com/v4/letter/g/5fc32e/32.png) [@gabriel.ratcliff](https://discuss.elastic.co/u/gabriel.ratcliff)\
**Post date:** [March 2, 2021, 11:18pm UTC](https://discuss.elastic.co/t/return-json-array-of-objects-via-webhook-and-script-transform/266030/1 "2021-03-02T23:18:05Z")

</div>

Hi there, I'm attempting to `POST` to an external webhook that takes an array of objects as a request body.

So far, all I've been able to output is a JSON object with a `_value` key that contains the array I'm looking for. Here's my `action`:

```auto
"actions": {
    "block-ip": {
      "transform": {
        "script": {
          "source": "def ip = '(ip.src eq ' + ctx.payload.aggregations.top_ip.buckets[0].key + ')'; def expression = ['expression': ip]; def payload = ['action': 'block', 'description': 'Automated IP Block', 'filter': expression]; return [payload];",
          "lang": "painless"
        }
      },
      "webhook": {
        "scheme": "http",
        "host": "HOST",
        "port": 80,
        "method": "post",
        "path": "/path",
        "params": {},
        "headers": {},
        "body": "{{#toJson}}ctx.payload{{/toJson}}"
      }
    }
  }

```

I'm able to grab/reference data easily, until it comes to the newly return `ctx.payload`.

Your docs say the following:

> The executed script may either return a valid model that is the equivalent of a Java™ Map or a JSON object (you will need to consult the documentation of the specific scripting language to find out what this construct is). Any other value that is returned will be assigned and accessible to/via the `_value` variable.

Which is what I'm seeing, and all the keys on ctx are `readonly` as marked by your docs.

Digging into the source code says that `toJson` should take an array as a parameter: [Mustache: Render Map as JSON by tlrx · Pull Request #18856 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/pull/18856/files#diff-85234ffce9b8d86b4a5b176c8373a8be3449ec162f2a10e6eb5ae57c84a5baefR230)

But I'm not able to get this to work how I'd like.

The output I'm seeing is

```auto
{
  _value: [
    {
      filter: [Object],
      action: 'block',
      description: 'Automated IP Block'
    }
  ]
}

```

But I'd like to bring everything up a level, to:

```auto
[
    {
      filter: [Object],
      action: 'block',
      description: 'Automated IP Block'
    }
  ]

```

Please help guide me in the right direction!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 30, 2021, 11:18pm UTC](https://discuss.elastic.co/t/return-json-array-of-objects-via-webhook-and-script-transform/266030/2 "2021-03-30T23:18:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.