Watcher email output ,access nested aggregations fields

Elastic Stack Kibana
1

hi guys,

i have below watcher simulation output ... how do i access and iterate over below fields and send them in email action

i am trying using {{ctx.payload.aggregations.2.buckets.3.buckets.4.buckets.1.value}} but not working

text to be sent in email body

value: 4835 , key: production1 , key:Succ
value: 4844, Key: production1, key:Succ

watcher output

"result": {
"execution_time": "2021-01-27T09:37:27.341Z",
"execution_duration": 9,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 3,
"failed": 0,
"successful": 3,
"skipped": 0
},
"hits": {
"hits": [],
"total": 6,
"max_score": null
},
"took": 7,
"timed_out": false,
"aggregations": {
"2": {
"buckets": [
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"4": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"value": 4835
},
"doc_count": 2,
"key": "production1"
}
]
},
"doc_count": 2,
"key": "Succ"
}
]
},
"key_as_string": "2021-01-27T12:36:30.000+03:00",
"doc_count": 2,
"key": 1611740190000
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"4": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"value": 4844
},
"doc_count": 2,
"key": "production1"
}
]
},
"doc_count": 2,
"key": "Succ"
}
]
},
"key_as_string": "2021-01-27T12:36:50.000+03:00",
"doc_count": 2,
"key": 1611740210000
},
{
"3": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"4": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"1": {
"value": 4890
},
"doc_count": 2,
"key": "production1"
}
]
},
"doc_count": 2,
"key": "Succ"
}
]
},
"key_as_string": "2021-01-27T12:37:10.000+03:00",
"doc_count": 2,
"key": 1611740230000
}
]
}
}
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"stored_fields": [
"*"
],
"aggs": {
"2": {
"date_histogram": {
"field": "@timestamp",
"fixed_interval": "10s",
"time_zone": "Asia",
"min_doc_count": 1
},
"aggs": {
"3": {
"terms": {
"field": "Counter_Name",
"order": {
"_key": "asc"
},
"size": 36
},
"aggs": {
"4": {
"terms": {
"field": "host",
"order": {
"1": "asc"
},
"size": 36
},
"aggs": {
"1": {
"max": {
"field": "Value"
}
}
}
}
}
}
}
}
` },

2

Hi @Muhammad_Faisal,

The templating language used in Watcher is Mustache. Demos of their APIs and details about how to loop through arrays can be found in its docs. They also have a playground on their website so you can test out your template.

I hope this helps with solving your question.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.