Watcher - include all errors in e-mail

[pp_macrix (Ptak)]

I've created a watch which shows me how many errors have been written in the log file (which is taken by logstash and then transferred to elasticSearch) for a specific range of time. For now in the email body I send the number of errors, which is configured in the watcher like this:

"actions" : {
"send_email" : { 
"email" : { 
"to" : "email@email.com", 
"subject" : "Watcher Notification", 
"body" : "{{ctx.payload.hits.total}} exceptions found.  
}
}
}

now I would like to add in the e-mail body the exact exceptions text. How should I do this? I

[spinscale (Alexander Reelsen)]

you can loop through the hits like hits

:{{#ctx.payload.hits.hits}}{{_source.my_field}}{{/ctx.payload.hits.hits}}

--Alex

[pp_macrix (Ptak)]

Thanks, it works. Can you please explain how this works? Eventually, how can I include more than one fields? For instance: I want to show the exact error message and also machine on which it occurs

[spinscale (Alexander Reelsen)]

I think the easiest way is to check out the mustache docs about lists, as this is what we are doing there https://mustache.github.io/mustache.5.html

You can basically select anything from inside the payload using the regular dot notation like foo.bar.baz that you also know from queries.