How to access document data (e.g. error message) in alert message using "Per document monitor" with "Extraction Query" (OpenSearch Alerting)

Plugins Alerting
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Hi I have configure OpenSearch Alert and giving query which will extract
“logEvents.message”: containing error message .The query running fine and giving logs which containing error logs. i want that Alert trigger that complete error log in the Email body i have used many syntax but it didnt work.

e.g : {
“subject”: “Alert: Error Detected in Logs”,
“body”: “Here are the log details:\n\nTotal Hits: {{ctx.results[0].hits.total.value}}\n\n{{#ctx.results[0].hits.hits}}\n- Message: {{_source.logEvents.message}}\n- Timestamp: {{_source.@timestamp}}\n{{/ctx.results[0].hits.hits}}”
}

Configuration:

Relevant Logs or Screenshots:

2

The document is located in ctx - alerts - sample documents array:

{{ctx.alerts.0.sample_documents.0._source}}

3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.