# Watcher payload modification converts list to object

**URL:** <https://discuss.elastic.co/t/watcher-payload-modification-converts-list-to-object/128760>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 19, 2018, 6:15pm UTC](https://discuss.elastic.co/t/watcher-payload-modification-converts-list-to-object/128760 "2018-04-19T18:15:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamthealex](https://avatars.discourse-cdn.com/v4/letter/i/e9c0ed/32.png) [@iamthealex](https://discuss.elastic.co/u/iamthealex)\
**Post date:** [April 19, 2018, 6:15pm UTC](https://discuss.elastic.co/t/watcher-payload-modification-converts-list-to-object/128760/1 "2018-04-19T18:15:18Z")

</div>

I create a watch,  
The watch action transform tries to replace the payload.  
I'm partially successful, but several items do not work as I expected

1. The payload is replaced, but I want to create a list of name-value pairs. I can create a list if I only use names. Once I used name value pairs, I get an array. How do I create a list in the transform?

2. When I try to print just the list, it gets turned into an object. Why is list important to me? Because I wish to use mustache to iterate over the list produced by the execution, and I don't know how to make mustache iterate over an object. [Iterate over object key/value pairs? · Issue #457 · janl/mustache.js · GitHub](https://github.com/janl/mustache.js/issues/457).

> Blockquote

DELETE \_xpack/watcher/watch/alex\_watch

```
PUT _xpack/watcher/watch/alex_watch
{
    "metadata" : {
        "name" : "DevOps Salt Minion Errors",
        "time_range" : "now-2d"
    },
    "trigger": { "schedule": { "interval": "30m" } },
    "input": {
        "search": {
            "request": {
                "indices": ["salt-minion-*"],
               "body": {
                    "query": {
                        "bool": {
                           "must": [
                                { "range" : { "@timestamp": { "gte": "{{ctx.metadata.time_range}}" } } },
                                { "exists" : { "field" : "text" } },
                                { "wildcard" : { "text" : "*failed*" } }
                            ]
                        }
                    },
                    "size" : 0,
                   "aggregations": { "by_text": { "terms": { "field": "text", "size": 2 } } }
                }
            }
        }
    },
   "condition": { "compare": { "ctx.payload.hits.total": { "gt": 0 } } },
    "actions": {
        "send-to-anelson": {
            "throttle_period" : "1h",
            "transform": {
              "script": "return ['title':'froggies', 'mylist' : ['bug','sev2'] , 'yourlist' : ['1':'one', '2':'two'] ] "  
            },
            "webhook" : {
           "method" : "POST",
            "url" : "https://hooks.slack.com/services/xxx",
            "headers" : { "Content-Type" : "application/json" },
            "body": "{ \"text\": \" \npayload=>{{ctx.payload}},\nmylist=>{{ctx.payload.mylist}},\nyourlist={{ctx.payload.yourlist}}\n \" } "
           }
        }
    }
}
POST _xpack/watcher/watch/alex_watch/_execute

```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 23, 2018, 1:44pm UTC](https://discuss.elastic.co/t/watcher-payload-modification-converts-list-to-object/128760/2 "2018-04-23T13:44:42Z")

</div>

please take the time to properly format your message, this is nearly impossible to read. As you can use markdown here, this makes it easy to create good readable examples, which also increases the possibility of help.

Returning a list can be done by

```auto
def list = [] ; list.add(1); list.add(2); return list

```

If you do not return a map, you can access the created field using `ctx.payload._value`.

Printing a list just calls `toString()` on it, and returns its string representation. This is intended. If you want to do do something with each element of a list, then you have to iterate through it. Iteration is done by calling `{{#ctx.payload.YOURLISTELEMENT}} here you do sth per element {{/ctx.payload.YOURLISTELEMENT}}`

You should check out our [alerting examples](https://github.com/elastic/examples/tree/master/Alerting), check out the [search template docs](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/search-template.html) for some more mustache examples

---

<div class="post-metadata">

**Author:** ![iamthealex](https://avatars.discourse-cdn.com/v4/letter/i/e9c0ed/32.png) [@iamthealex](https://discuss.elastic.co/u/iamthealex)\
**Post date:** [April 23, 2018, 6:19pm UTC](https://discuss.elastic.co/t/watcher-payload-modification-converts-list-to-object/128760/3 "2018-04-23T18:19:44Z")

</div>

Spinscale,

I tried to fix the markdown.  
Thanks for your response, I now understand that it only looks like list-\>object when toString is used.  
I have it working now.  
Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2018, 6:22pm UTC](https://discuss.elastic.co/t/watcher-payload-modification-converts-list-to-object/128760/4 "2018-05-21T18:22:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.