# Watcher : Extract \_source field in transform

**URL:** <https://discuss.elastic.co/t/watcher-extract-source-field-in-transform/220607>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 24, 2020, 9:26am UTC](https://discuss.elastic.co/t/watcher-extract-source-field-in-transform/220607 "2020-02-24T09:26:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saurabh\_Singh1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saurabh_singh1/32/63178_2.png) [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\
**Post date:** [February 24, 2020, 9:27am UTC](https://discuss.elastic.co/t/watcher-extract-source-field-in-transform/220607/1 "2020-02-24T09:27:00Z")

</div>

Hello all,  
I am trying to create a watcher based on my input query and trying to ingest data in  
another index. I have a multilevel output from the query and i am trying to transform that payload.

```
My input payload looks like this :

```

"aggregations": {  
"Test1": {  
"doc\_count\_error\_upper\_bound": 0,  
"sum\_other\_doc\_count": 134710,  
"buckets": [  
{  
"key": "Saurabh",  
"doc\_count": 17621,  
"Test2": {  
"doc\_count\_error\_upper\_bound": 0,  
"sum\_other\_doc\_count": 0,  
"buckets": [  
{  
"key": "1.1.1.1",  
"doc\_count": 17621,  
"aggregation\_name": {  
"hits": {  
"total": {  
"value": 17621,  
"relation": "eq"  
},  
"max\_score": null,  
"hits": [  
{  
"\_index": "index-test",  
"\_type": "\_doc",  
"\_id": "adsgkasdlljdal",  
"\_score": null,  
"\_source": {  
event": {  
**"place": "paris"**  
}\*\*  
},  
"sort": [  
1582178379000  
]  
}  
]  
}  
}  
}  
]  
}  
}

Now as part of my action ( transform ) i need to get value of \_source.event.place and store it in a variable

def document = ['var1': i.key , 'var2': j.key , 'thirdloop': \_source.event.place];

output i am getting is : [var1: 'Saurabh' , var2: '1.1.1.1' , var3: 'empty']

**Can anybody help me to extract the fields under \_source??**

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 24, 2020, 1:25pm UTC](https://discuss.elastic.co/t/watcher-extract-source-field-in-transform/220607/2 "2020-02-24T13:25:54Z")

</div>

This is impossible to answer without more information how your payload looks like.'

Can you provide a sample execute watch API call, with an `simple` input mimicking your payload and your transform?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/watcher-extract-source-field-in-transform/220607/3 "2020-03-23T13:25:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.