# Watcher action returns some payload, but not others

**URL:** <https://discuss.elastic.co/t/watcher-action-returns-some-payload-but-not-others/236365>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 9, 2020, 2:45pm UTC](https://discuss.elastic.co/t/watcher-action-returns-some-payload-but-not-others/236365 "2020-06-09T14:45:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [June 9, 2020, 2:45pm UTC](https://discuss.elastic.co/t/watcher-action-returns-some-payload-but-not-others/236365/1 "2020-06-09T14:45:37Z")

</div>

Hi ,

I have the following watcher action :

```
"send_email": {
              "transform": {
                "script": {
              "source": 
              """
              def documents = ctx.payload.hits.hits.stream()
            .map(hit -> [
              "time": hit._source['@timestamp'],
              "source.user": hit._source.EventData.SubjectUserName,
              "destination.user": hit._source.EventData.TargetUserName,
              "message": hit._source.System.Keywords
            ])
            .collect(Collectors.toList());
            return documents[0]; 
              """
            }
              },
              "email" : { 
                "to" : "<<redacted>>", 
                "subject" : "Watcher Notification", 
                "body" : "On {{ctx.payload.time}}, {{ctx.payload.source.user}} is making changes to {{ctx.payload.destination.user}} with message {{ctx.payload.message}}"
              }
            }

```

Upon watch execution, I can see that the transform returns expected payload. however, on the action section, some payload are returned while others are not.

transform result :

```
"transform" : {
            "type" : "script",
            "status" : "success",
            "payload" : {
              "time" : "2020-05-29T06:51:54.969Z",
              "source.user" : "<redacted>",
              "destination.user" : "<redacted>",
              "message" : "Audit Success"
            }
          },

```

action result. :

```
"email" : {
            "account" : "office365",
            "message" : {
              "id" : "send_email_modify-ad_eedaa620-e8e6-4984-b33e-9b6fc21b0113-2020-06-09T14:37:47.69609Z",
              "from" : "<redacted>",
              "sent_date" : "2020-06-09T14:37:47.714366Z",
              "to" : [
                "<redacted>"
              ],
              "subject" : "Watcher Notification",
              "body" : {
                "text" : "On 2020-05-29T06:51:54.969Z, is making changes to with message Audit Success"
              }
            }
          }

```

The time and message field are returned correctly, while source.user and destination.user are just blanks. Strangely enough, putting just {{ctx.payload}} returned all entries.

Did i miss something obvious?

TIA

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 30, 2020, 8:07am UTC](https://discuss.elastic.co/t/watcher-action-returns-some-payload-but-not-others/236365/2 "2020-06-30T08:07:01Z")

</div>

Try not to use dots within field names. Try `destination_user` and see if htat solves the problem.

---

<div class="post-metadata">

**Author:** ![ptamba](https://avatars.discourse-cdn.com/v4/letter/p/7feea3/32.png) [@ptamba](https://discuss.elastic.co/u/ptamba)\
**Post date:** [July 1, 2020, 2:57pm UTC](https://discuss.elastic.co/t/watcher-action-returns-some-payload-but-not-others/236365/3 "2020-07-01T14:57:59Z")

</div>

yup, a friend figured that out as well

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2020, 2:58pm UTC](https://discuss.elastic.co/t/watcher-action-returns-some-payload-but-not-others/236365/4 "2020-07-29T14:58:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.