How to include iterative value in message body ctx.results.hits[i>=0]

[asikarwar]

OK, yes this works, thanks!
Did you happen to try how we can aggregate the output by host?
Any thoughts on this would great.

Mustache template aggregate, group by

I went through the following topic: I also need to aggregate the result. I can create the message output using the following: triggered Alert for Host: {{_source.host.name}} with Severity: {{ctx.trigger.severity}} for log level *{{_source.log.level}} event_id: {{_source.winlog.event_id}} But how can i aggregate the alert message output by host and the number/total count of event_id using the query response? Desired Output: Trigger: Test Trigger if Event_id count >= 1 Severity: 1 Period…