How do I extract the description field below when it is in the array? See samples below as I’ve tried many ways but still no results.
Sample data:
{
“_shards”: {
“total”: 10,
“failed”: 0,
“successful”: 7,
“skipped”: 0
},
“hits”: {
“hits”: [
{
“_source”: {
“srcaddr”: “xxx.xxx.xxx.xxx”,
“dstport”: “9999”,
“destination”: {
“address”: “yyy.yyy.yyy.yyy”,
“port”: “8888”,
“ip”: “yyy.yyy.yyy.yyy”
},
…
…
“event.hiking_route”: [
{
“indicator”: {
“reference”: “https://trail.com/type/ip/aaa.aaa.aaa.aaa”,
“name”: “tripping blue”,
“description”: “mountain route with great scenery”,
“modified_at”: “2023-10-12T20:22:56Z”,
“type”: “difficult”
},
“matched”: {
“field”: [
“source.ip”,
“related.ip”
]
}
}
],
…
…
I’ve tried these extraction but still get the empty results:
Well, I’ve figured out the alternative way to extract the fields inside {{ctx.results.0.hits.hits.0._source.*}} by using “_source” includes and excludes conditions in “Define Extraction Query”
and using {{ctx.results}} to print all “_source”“includes” fields inside the Actions Message alert. Basically, these are the steps:
Use “_source” includes to include selected fields to be included in the results
Inside “Define Extraction Query”
{
“size”: 2, ## Make sure “size” is > 0 for the query to return _source includes fields
“query”: {
“bool”: {
“filter”: [
Use {{ctx.results}} to print out all includes fields inside the message:
Inside Actions Message:
Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.