From fb0aa61093a7846826ec3ccfdfc102d17716cfd0 Mon Sep 17 00:00:00 2001 From: mmahacek Date: Fri, 27 Jun 2025 15:00:59 -0700 Subject: [PATCH] Update action-foreach.md --- explore-analyze/alerts-cases/watcher/action-foreach.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/explore-analyze/alerts-cases/watcher/action-foreach.md b/explore-analyze/alerts-cases/watcher/action-foreach.md index f87463ef06..309d1ecb62 100644 --- a/explore-analyze/alerts-cases/watcher/action-foreach.md +++ b/explore-analyze/alerts-cases/watcher/action-foreach.md @@ -45,3 +45,7 @@ PUT _watcher/watch/log_event_watch ``` 1. The logging statement will be executed for each of the returned search hits. + +::::{note} +If you are running a [`script`](transform-script.md) {{watcher-transform}}, the transform needs to be included prior to the `actions` section to ensure the output is available to the `foreach` loop. +::::