Using ctx.results Variable in a Message

Elastic Stack Kibana
1

I'd like to use the ctx.results variable in a message using {{ctx.results.0}} but I am not able to display the _source value I'm interested in.

For example, the extraction query response is:

{
    "_shards": {
        "total": 123,
        "failed": 0,
        "successful": 123,
        "skipped": 0
    },
    "hits": {
        "hits": [
            {
                "_index": "winlogbeat-6.8.6-2019.12.26",
                "_type": "_doc",
                "_source": {
                    "process_id": 4,
                    "computer_name": "machine1.foo.com",
                    "keywords": [
                        "Audit Success"
                    ],

and I would like to print the computer_name value in the message body. I tried {{ctx.results.0._source.computer_name.value}} and various other combinations, but none worked. Do you have any advice?

Thanks,
Steve

2

You can use this as a guide: Cannot figure out how to get data from _source into Watch Output

3

My problem was that I was (incorrectly) attempting to reference the entire array, rather than an element in the array. Once I referenced the element, the issue was resolved.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.