# Watcher email to show every hit's message separately

**URL:** <https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 5, 2015, 3:30am UTC](https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985 "2015-06-05T03:30:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jiawen](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Jiawen](https://discuss.elastic.co/u/Jiawen)\
**Post date:** [June 5, 2015, 3:30am UTC](https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985/1 "2015-06-05T03:30:11Z")

</div>

I have build a watcher on my ES master node. And use email as action, to collect all the error event in last minute.  
Then I found there will be dozens of hits in one minute.  
Like:  
my-watch executed with 19 hits  
ctx.payload.hits.hits : {0={\_index=..., 1={\_index =...,  
....  
18 ={\_index=...  
}

Is there a way that I can show only one field(like error message) for each hit?

---

<div class="post-metadata">

**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\
**Post date:** [June 5, 2015, 8:15am UTC](https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985/2 "2015-06-05T08:15:47Z")

</div>

You can use a [tranform](https://www.elastic.co/guide/en/watcher/current/anatomy-transform.html) to change the payload. Using the `script` transform you can iterate over the hits and create a new array with only the messages... something along the lines of:

```
{
  "input" : {
    "search" : { ... }
  },
  "condition" : { ... },
  "transform" : {
    "script" : "return ['errors' : ctx.payload.hits.hits.collect { it._source.message }]"
  }
}

```

The transform above extracts the messages from the hits and the payload is replaced with an array of all the extracted messages (refer to the array in your email template by `ctx.payload.errors`)

---

<div class="post-metadata">

**Author:** ![Jiawen](https://avatars.discourse-cdn.com/v4/letter/j/e480ec/32.png) [@Jiawen](https://discuss.elastic.co/u/Jiawen)\
**Post date:** [June 8, 2015, 3:00am UTC](https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985/3 "2015-06-08T03:00:07Z")

</div>

Thanks uboness~ It works.  
I never used transform part before, I will see what else I can do to use it.

---

<div class="post-metadata">

**Author:** ![11194](https://avatars.discourse-cdn.com/v4/letter/1/58956e/32.png) [@11194](https://discuss.elastic.co/u/11194)\
**Post date:** [September 24, 2015, 3:42am UTC](https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985/4 "2015-09-24T03:42:10Z")

</div>

I would like to send out email to transform the data inside orchestration, how do?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/watcher-email-to-show-every-hits-message-separately/1985/5 "2017-07-06T13:48:30Z")

</div>