Watcher action: substitute the found data in the "path" of action

[andres-perez (Andrés Pérez)]

Hi!
If your search returns:

1. Just 1 IP, that task should be straightforward: just add the (mustache template) variable which contains it within your payload.

2. A list of results and your ipban web service can handle multiple IPs passed in the url: you might build the variable section of your path using the mustache template options to iterate a list.

There is a good example of 1 and 2 in this response:

Iterate over hits to get value of fields for my hits in my Mail box body from Watcher

Hey, the number in the mustache template represents the index {{ctx.payload.hits.hits.0._source.CardNumber}}, so you could access other elements by increasing it. However what you really want, is looping through your results... try this snippet and check your logs if that suits your use-case DELETE foo PUT foo/bar/1 { "name" : { "first" : "Kobe", "last" : "Bryant" } } PUT foo/bar/2 { "name" : { "first" : "Stephen", "last" : "Curry" } } PUT foo/bar/3 { "name" : { …

You can see the exact contents of your search using the simulation tab of your watch.

If you need more complex processing, you can also include a transform section with a script to make the modifications and replace the payload or add a field with the desired value.
Then you can use the resulting field like the previous points 1 or 2.

Payload transforms | Elasticsearch Guide [8.11] | Elastic