Using user defined variables in Query Extraction Editor Trigger Script in Actions message template

    Hey there! I am developing an alert using Extraction Query Editor. This single alert monitors the CPU load of many hosts assigned to different domains, so in query I use aggregation:

"aggregations": {
        "domain": {
            "terms": {
                "field": "fields.test_domain"
            },
            "aggregations": {
                "hostname": {
                    "terms": {
                        "field": "host.hostname"
                    },
                    "aggregations": {
                        "avgcpu": {
                            "avg": {
                                "field": "host.cpu.pct"
                            }
                        }
                    }
                }
            }
        }
    }

My trigger condition checks if any element (CPU value) in aggregation buckets meets the condition:

int score = 0;
ArrayList fhosts = new ArrayList();


for (int i = 0; i < ctx.results[0].aggregations.domain.buckets.size(); i++)
{	
	String domain = ctx.results[0].aggregations.domain.buckets[i].key;
	for (int j = 0; j < ctx.results[0].aggregations.domain.buckets[i].hostname.buckets.size(); j++)
	{	
		String hostname = ctx.results[0].aggregations.domain.buckets[i].hostname.buckets[j].key;
		if (ctx.results[0].aggregations.domain.buckets[i].hostname.buckets[j].avgcpu.value > 0.7)
		{
			score += 1;
			Map fhost = new HashMap();
			fhost.put("domain", domain);
			fhost.put("hostname",hostname);
			fhost.put("metricname", "CPU");
			fhost.put("metricvalue", ctx.results[0].aggregations.domain.buckets[i].hostname.buckets[j].avgcpu.value);
			fhosts.add(fhost);
		}
	}
}
if (score > 0) 
{
	return true;
} else {
	return false;
}

In trigger actions for templating the message, I would like to use the fhosts elements to show only hostnames matching to alert condition and I can't understand how I can do it now

Originally posted by @bg4erem in https://github.com/opensearch-project/alerting/issues/50#issuecomment-1372969359

No files or tests are named. Start by tracing how the trigger script variables are handled when an alert action message is rendered, using the shown fhosts list and message-template request as the behavioral guide. Done means matching hosts can be displayed in the action message, with coverage for the relevant templating path.