# Xpack watcher : - Get Index name in action's email body

**URL:** <https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639>\
**Category:** Elasticsearch\
**Created:** [January 9, 2018, 5:09am UTC](https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639 "2018-01-09T05:09:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shivanshu\_Bagga](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)\
**Post date:** [January 9, 2018, 5:09am UTC](https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639/1 "2018-01-09T05:09:56Z")

</div>

Hi,

I want to set a watcher to read last 3 indices name start with "logstash-\*" with number of documents per index.Then send a alert to admin user. Indices are created with current data format.For example index name for 9th Jan 2018 is "logstash-2018.01.09".

Here is my current configuration -

```
PUT _xpack/watcher/watch/my-watch
{
  "trigger": {
    "schedule": {
      "interval": "10000s"
    }
  },
   "input" : {
  "chain" : {
    "inputs" : [ 
      {
        "first" : {
     "search": {
      "request": {
        "indices": [
          "<logstash-{now/d}>"
        ],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
              ]
            }
          }
        }
      }
      }
        }
      },
      {
        "second" : {
      "search": {
      "request": {
        "indices": [
          "<logstash-{now/d-1d}>"
        ],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
              ]
            }
          }
        }
      }
      }
        }
      },
            {
        "third" : {
     "search": {
      "request": {
        "indices": [
          "<logstash-{now/d-2d}>"
        ],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
              ]
            }
          }
        }
      }
      }
        }
      }
    ]
  }
},
  "actions": {
    "send_email": {
      "email": {
        "to": "",
        "subject": "ELK Notifications",
          "body": {
          "html": "<ul><li>Today : - {{ctx.payload.first.hits.total}}</li><li>Yesterday : - {{ctx.payload.second.hits.total}}</li><li>The day before yesterday : - {{ctx.payload.third.hits.total}}</li></ul>"
        }
    }
}
}
}

```

How can I set index name Today , Yesterday and The day before yesterday in action's email body.

I tried to set "\<logstash-{now/d}\>" email body , but it did not worked.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 9, 2018, 8:34am UTC](https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639/2 "2018-01-09T08:34:46Z")

</div>

Hey,

there is no super simple way to find the index name, as it is not returned as part of the response. However, when there is a search hit, each hit contains the index it was found in.

You can safely remove the `query` part from your inputs, as it is doing nothing. If you change the `size` parameter to `1`, you can access the first search hit and extract the index name from there.

--Alex

---

<div class="post-metadata">

**Author:** ![Shivanshu\_Bagga](https://avatars.discourse-cdn.com/v4/letter/s/e495f1/32.png) [@Shivanshu\_Bagga](https://discuss.elastic.co/u/Shivanshu_Bagga)\
**Post date:** [January 9, 2018, 8:43am UTC](https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639/3 "2018-01-09T08:43:48Z")

</div>

Thanks ,

One more question {{ctx.payload.fourth.nodes.gdnF8AEHSXWISPlGy1FOCA.fs.total.available\_in\_bytes}} giving me fs bytes , I wanna it convert to MB before send email to admin.

I did -

```
  "actions": {
    "send_email": {
      "transform" : {
        "script" : "return ctx.payload.fourth.nodes.gdnF8AEHSXWISPlGy1FOCA.fs.total.available_in_bytes/1024"
      },
      "email": {
        "to": "",
        "subject": "ELK Notifications",
          "body": {
          "html": "<b>ELK Notification Messages {{ctx.payload._value}}</b><br/>Cluster API :- <ul><li>Cluster Name : -{{ctx.payload.five.cluster_name}} </li><li>status :- {{ctx.payload.five.status}}</li></ul>Node API :-<ul><li>Node :-gdnF8AEHSXWISPlGy1FOCA</li><li>CPU Usages : - {{ctx.payload.fourth.nodes.gdnF8AEHSXWISPlGy1FOCA.os.cpu.percent}} %</li><li>Heap Memory :- {{ctx.payload.fourth.nodes.gdnF8AEHSXWISPlGy1FOCA.jvm.mem.heap_used_percent}} %</li><li>Fs available(In bytes) :- {{ctx.payload.fourth.nodes.gdnF8AEHSXWISPlGy1FOCA.fs.total.available_in_bytes}}</li></ul>Documents Processed :- <ul><li>Today : - {{ctx.payload.first.hits.total}}</li><li>Yesterday : - {{ctx.payload.second.hits.total}}</li><li>The day before yesterday : - {{ctx.payload.third.hits.total}}</li></ul>"
        }
    }
}
}

```

Now I'm only getting {{ctx.payload.\_value}} not other values(all other values now coming blank) , How can I access other values also.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 9, 2018, 9:17am UTC](https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639/4 "2018-01-09T09:17:54Z")

</div>

Hey,

this does not look like a search request, but rather like a nodes stats request. If so you can just append the `human=true` parameter, and you will get units in MB as well.

Regarding the transform. Whatever you return will replace the existing payload, so you need to include that one as well.

```auto
def payload = ctx.payload ; payload.foo = ctx.payload.nodes.../1024 ; return payload

```

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2018, 9:18am UTC](https://discuss.elastic.co/t/xpack-watcher-get-index-name-in-actions-email-body/114639/5 "2018-02-06T09:18:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.