XPACK Alerting "extract" same field from all hits

I am creating an alert in XPACK WATCHER -

I get the results as json but I want to extract one field from the result set (hits).

I want to achieve the following:


This works when I actually put a number in place of the wildcard. How can I extract a field from the result set from all the documents?


FYI - in case someone else is also searching for this - you achieve this by defining the fields in the query statement.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.