# Adding data from signals query into message

**URL:** <https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200>\
**Category:** Signals Alerting\
**Created:** [August 10, 2021, 3:15pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200 "2021-08-10T15:15:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ericl](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@ericl](https://forum.search-guard.com/u/ericl)\
**Post date:** [August 10, 2021, 3:15pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200/1 "2021-08-10T15:15:14Z")

</div>

Lets say i get an array of results when firing a signals alert. Is there a way to iterate through all the results and include them in the message that’s being sent out from the alert?

---

<div class="post-metadata">

**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\
**Post date:** [August 10, 2021, 4:24pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200/2 "2021-08-10T16:24:58Z")

</div>

Hi @ericl

You can use something like the below notation:

{{#data.mysearch.hits}}  
{{.}}  
{{/data.mysearch.hits}}

Hope this helps

---

<div class="post-metadata">

**Author:** ![ericl](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@ericl](https://forum.search-guard.com/u/ericl)\
**Post date:** [August 10, 2021, 8:37pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200/3 "2021-08-10T20:37:20Z")

</div>

I was able to do this and display the entire blob and display the entire result set in the message but i was unable to display specific elements that exist. Let’s say one of the fields in my data was appName and i wanted to iterate through every record and display all of the appNames that appeared in the result set is there a way to do this?

---

<div class="post-metadata">

**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\
**Post date:** [August 10, 2021, 8:53pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200/4 "2021-08-10T20:53:33Z")

</div>

@ericl  
Can you provide example of the data you get back from the search?

Using below data:

```auto
{
  "watch": {
    "id": "__inline_watch",
    "tenant": "_main"
  },
  "data": {
    "mysearch": {
      "_shards": {
        "total": 1,
        "failed": 0,
        "successful": 1,
        "skipped": 0
      },
      "hits": {
        "hits": [
          {
            "_type": "_doc",
            "_source": {
              "val1": [
                "a",
                "b",
                "c"
              ]
            },
            "_id": "SBTJMHsBKUcUZn4ksA-5",
            "_index": "test",
            "_score": 0.05129329
          }, ...

```

If you wanted to loop through entries in val1 (a,b,c), the syntax would look as follows:

```auto

  {{#data.mysearch.hits.hits}}
 
  {{#_source.val1}}
  {{.}}
  {{/_source.val1}}
  
  {{/data.mysearch.hits.hits}}

```

---

<div class="post-metadata">

**Author:** ![ericl](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@ericl](https://forum.search-guard.com/u/ericl)\
**Post date:** [August 10, 2021, 9:33pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200/5 "2021-08-10T21:33:54Z")

</div>

Would that work in the body portion of an email message i’m sending from an alert?

---

<div class="post-metadata">

**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\
**Post date:** [August 10, 2021, 10:00pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200/6 "2021-08-10T22:00:45Z")

</div>

I tested with Slack and it works as expected, haven’t tested with email yet, but would assume it will work the same.

---

<div class="post-metadata">

**Author:** ![ericl](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@ericl](https://forum.search-guard.com/u/ericl)\
**Post date:** [August 19, 2021, 3:26pm UTC](https://forum.search-guard.com/t/adding-data-from-signals-query-into-message/2200/7 "2021-08-19T15:26:27Z")

</div>

This worked great thank you so much