# Watcher send content of Key-Value
**URL:** https://discuss.elastic.co/t/watcher-send-content-of-key-value/163349
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [January 8, 2019, 10:55am UTC](https://discuss.elastic.co/t/watcher-send-content-of-key-value/163349 "2019-01-08T10:55:13Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Alejandro\_Martinez\_F](https://discuss.elastic.co/u/Alejandro_Martinez_F)
#### Post date: [January 8, 2019, 10:55am UTC](https://discuss.elastic.co/t/watcher-send-content-of-key-value/163349/1 "2019-01-08T10:55:13Z")
Hello!!
I'm using the watcher to send notifications. For example, an email notification. I would like to include value of Key-Values on email notification.
Practical case example,
I have a watcher that firing when found on a "Down" value on a "status" Key-value.
When watcher it's firing I would like to include content on "server-name" Key-value on email notification.
Is it possible to do it? How?
With {{ctx}} i cannot do it. I only can include for example how many coincidences "Down" I have ({{ctx.payload.hits.total}}).
Thanks.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 9, 2019, 9:05am UTC](https://discuss.elastic.co/t/watcher-send-content-of-key-value/163349/2 "2019-01-09T09:05:55Z")
I am not sure I understand the question fully from your description, so maybe this answer is misleading.
First, whatever is returned as part of your input (be it a search or a HTTP request), can be used in the content when sending an email. `ctx.payload` includes all your search results.
From what I read the best way forward would be to create a query that contains the proper data. In your case I assume you would like to know all the hosts within a timerange that have a `down` event - this means, you need to write a query filtering by time range and down event and then aggregate on the hostname, so that you get a list of hosts as part of the aggregations.
You can then access `ctx.payload.aggregations` fields and extract the hosts that were found to be down.
A good way to get started with these kind of things is to check out the [examples repo](https://github.com/elastic/examples/tree/master/Alerting)
Also, in order to keep your development cycles as short as possible, you should definetely read [this blog post about writing and debugging watches](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches).
Hope this helps as a start. If not, please always provide the full watch and the output of the execute watch API, when asking questions.
---
### Author:  [@Alejandro\_Martinez\_F](https://discuss.elastic.co/u/Alejandro_Martinez_F)
#### Post date: [January 11, 2019, 2:12pm UTC](https://discuss.elastic.co/t/watcher-send-content-of-key-value/163349/3 "2019-01-11T14:12:20Z")
Alex, thanks for all. My problem was because `size` was with value '0'.
When you change this value to '1', on the feedback he include first mach.
If you put for example, `"size" : "10"` on `"attached_data"` I have 10 first maches.
Now at email notification, for example, with next code, I receive the timestamp for the first mach.
> ```
> "body":{
> "text": "Test {{ctx.payload.hits.hits.0._source.@timestamp}}"}
>
> ```
Regards.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 8, 2019, 2:12pm UTC](https://discuss.elastic.co/t/watcher-send-content-of-key-value/163349/4 "2019-02-08T14:12:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.