# Watcher Use Source Fields

**URL:** <https://discuss.elastic.co/t/watcher-use-source-fields/178732>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 27, 2019, 12:38am UTC](https://discuss.elastic.co/t/watcher-use-source-fields/178732 "2019-04-27T00:38:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ericrs22](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@Ericrs22](https://discuss.elastic.co/u/Ericrs22)\
**Post date:** [April 27, 2019, 12:38am UTC](https://discuss.elastic.co/t/watcher-use-source-fields/178732/1 "2019-04-27T00:38:58Z")

</div>

I'm hoping to get source fields to notify for bruteforce attempts. Any recommendations? My results beyond attempts are blank.

```
{
  "trigger": {
    "schedule": {
      "interval": "10s"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "*"
        ],
        "types": [],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "event_id:4625",
                    "analyze_wildcard": true,
                    "default_field": "*"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-5m",
                      "to": "now"
                    }
                  }
                }
              ],
              "filter": [],
              "should": [],
              "must_not": []
            }
          },
          "aggs": {
            "User": {
              "terms": {
                "field": "event_data.TargetUserName"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 10
      }
    }
  },
  "actions": {
    "notify-slack": {
      "throttle_period_in_millis": 300000,
      "slack": {
        "account": "ELKBot",
        "message": {
          "from": "ELKBot",
          "to": [
            "#NOC"
          ],
          "text": "BRUTEFORCE ATTEMPT DETECTED",
          "attachments": [
            {
              "color": "danger",
              "title": "BRUTEFORCE",
              "text": "Number of Attempts: {{ctx.payload.hits.total}} Host: {{ctx._source.host.name}} User: {{ctx._source.event_data.TargetUserName}} Details: {{ctx._source.message}}"
            }
          ]
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 30, 2019, 12:05pm UTC](https://discuss.elastic.co/t/watcher-use-source-fields/178732/2 "2019-04-30T12:05:15Z")

</div>

The syntax to access the source is `ctx.payload.hits.hits.0._source.host.name` to access the first field. The payload just resembles a regular search response in this case.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 28, 2019, 12:05pm UTC](https://discuss.elastic.co/t/watcher-use-source-fields/178732/3 "2019-05-28T12:05:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.