Split or cut from context_hits iteration in Elasticsearch query rule


I'm newbie in Elasticsearch monitoring.

I'm trying to get only a few strings or characters from an context_hits iteration like this:


I have too many information in message field. I would like to use only a few words or characters from this field to report in slack message action. Is any way to cut, split or some other method to do this?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.