Surfacing Index Field Values in Kibana Alerts

Elastic Stack Kibana
2

I figured it out based on the documentation linked above (needed to read it properly!)

Here's how I got it working to show the fields from the first 'hit':

{{#context.hits.0}}{{_source.<your_field>}}{{/context.hits.0}}

See the example beneath context.hits at Elasticsearch query | Kibana Guide [7.15] | Elastic where it says:

"The most recent ES documents that matched the query. Using the Mustache template array syntax, you can iterate over these hits to get values from the ES documents into your actions."

Hope this helps anyone that comes across this post in the future!

1 Like