Watcher Sending Slack dynamic Attachments

[vaidabhishek (Abhishek Vaid)]

• I'm setting a watcher on ELK 6.2 to send dynamic attachments. I just want to extract string in the key message of all the hits. Below is the actions defined on my watcher. It's not working. The text is coming fine in the Alert, but not the attachment. The query returns hits, where _source only has one field message.

"actions": {
    "notify_slack": {
      "throttle_period_in_millis": 300,
      "slack": {
        "message": {
          "to": [
            "#seo-alerts"
          ],
          "text": "[SEO NGiNX Alert] [/getSeoPages] ({{ctx.payload.hits.total}} Errors)",
          "dynamic_attachments": {
            "list_path": "ctx.payload.hits.hits",
            "attachment_template": {
              "color": "danger",
              "title": "{{message}}",
              "text": "{{message}}"
            }
          }
        }
      }
    }
  }

This is what I get in my slack:

[spinscale (Alexander Reelsen)]

you are inside of a hits array, this means you should try to use {{_source.message}} to access the proper field, I assume your fields are just empty with your setup.