Truncate a Mustache variable in an Alerting rule action (e.g. limit a long text field to N words)?

Elastic Stack Kibana
1

Hello Team,

Kibana version: 9.x

We have a rule (Elasticsearch query rule type) that runs every few minutes against an index of banking transaction logs. When it matches, the action is an Index connector that writes a summary record into a separate payment index. The action's document body uses a Mustache template that loops over context.hits and builds one delimited "row" per matched document, e.g.:

{
  "message": "{{#context.hits}}{{#_source}}{{#FormatDate}}{{{@timestamp}}};Europe/London{{/FormatDate}},{{TransactionContext.SourceSystem}},{{TransactionContext.TargetSystem}},{{ErrorContext.ErrorDescription}}|{{/_source}}{{/context.hits}}"
}

Sample log:

{
  "@timestamp": "2026-08-07T07:00:00.000Z",
  "TransactionContext": {
    "SourceSystem": "PaymentGateway",
    "TargetSystem": "CoreBanking"
  },
  "ErrorContext": {
    "ErrorDescription": "java.lang.RuntimeException: Connection timed out, retrying failed at com.bank.service.PaymentService.process(PaymentService.java:142), caused by java.net.SocketTimeoutException: Read timed out at java.base/sun.nio.ch.NioSocketImpl.timedRead(NioSocketImpl.java:283), at java.base/sun.nio.ch.NioSocketImpl.implRead(NioSocketImpl.java:309) ... [continues for several hundred words]"
  }
}

The problem

ErrorContext.ErrorDescription (exception message) can run into hundreds of words. We only want the first ~50 words of it to land in the payment index record - everything else in the row should render as-is, untouched.

Is an ingest pipeline the only way to fix this issue? I was looking for any Mustache function that can handle this at runtime.

Will the below GitHub issue fix this in future? elastic/kibana#230634 — provide mustache lambda to substitute strings

Thanks!!