Transforming query data in an alert

My use case is that I have log data with a message and exception fields, and I am sending slack alerts when the query finds log level >= ERROR.
However the exception field is too big to put into slack messages, it means the message gets chunked, which then ruins the formatting.
I would like to truncate it to the first N characters so at least I get some indication in the alert.
There is no way to do this in Mustache templates (apparently).
Is there any way to transform the result data prior to feeding it into the alert template?
Either in the trigger script, or in the query itself?


Anyone have an answer to this? Also not sure how to do this in opendistro.

Following up on this. Did anyone find the solution/workaround for this?

If you do not upgrade to version 2.9, you can find a transformation hack in this thread of mine.