Watcher email to show every hit's message separately

Elastic Stack Elasticsearch
1

I have build a watcher on my ES master node. And use email as action, to collect all the error event in last minute.
Then I found there will be dozens of hits in one minute.
Like:
my-watch executed with 19 hits
ctx.payload.hits.hits : {0={_index=..., 1={_index =...,
....
18 ={_index=...
}

Is there a way that I can show only one field(like error message) for each hit?

1 Like
2

You can use a tranform to change the payload. Using the script transform you can iterate over the hits and create a new array with only the messages... something along the lines of:

{
  "input" : {
    "search" : { ... }
  },
  "condition" : { ... },
  "transform" : {
    "script" : "return [ 'errors' : ctx.payload.hits.hits.collect { it._source.message } ]"
  }
}

The transform above extracts the messages from the hits and the payload is replaced with an array of all the extracted messages (refer to the array in your email template by ctx.payload.errors)

1 Like
3

Thanks uboness~ It works.
I never used transform part before, I will see what else I can do to use it.

4

I would like to send out email to transform the data inside orchestration, how do?