Using ctx.results Variable in a Message

I'd like to use the ctx.results variable in a message using {{ctx.results.0}} but I am not able to display the _source value I'm interested in.

For example, the extraction query response is:

    "_shards": {
        "total": 123,
        "failed": 0,
        "successful": 123,
        "skipped": 0
    "hits": {
        "hits": [
                "_index": "winlogbeat-6.8.6-2019.12.26",
                "_type": "_doc",
                "_source": {
                    "process_id": 4,
                    "computer_name": "",
                    "keywords": [
                        "Audit Success"

and I would like to print the computer_name value in the message body. I tried {{ctx.results.0._source.computer_name.value}} and various other combinations, but none worked. Do you have any advice?


You can use this as a guide: Cannot figure out how to get data from _source into Watch Output

My problem was that I was (incorrectly) attempting to reference the entire array, rather than an element in the array. Once I referenced the element, the issue was resolved.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.