Is there a way to do the equivalent of a map in workflows?

[knownasred]

I would love to have a way to combine inside of one variable each of the elements of the array generated by a keep provider alert search.
Here's the current state of my setup, and I'm wondering of how to have a single execution of the console action (will be replaced by discord when ready)

workflow:
  id: e9d0c9f0-fdf8-475c-89ca-d4847ad2a62e
  name: Incident Notifier
  description: Notifies discord on new incident
  disabled: false
  triggers:
    - type: manual
    - type: incident
      events:
        - created
  inputs: []
  consts:
    eventId: cd392d5a-c094-4866-bf8f-c9f3adaa9dfb
  owners: []
  services: []
  steps:
    - name: getAllAlerts
      provider:
        type: keep
        config: "{{ providers.default-keep }}"
        with:
          filter: incident.id == "{{ consts.eventId }}"
          version: 2
    - name: python-step
      provider:
        type: python
        config: "{{ providers.default-python }}"
        with:
          code: |
            test
      vars:
        test: "{{ steps.getAllAlerts.results }}"
  actions:
    - name: console-action
      provider:
        type: console
        config: "{{ providers.default-console }}"
        with:
          message: Test {{ steps.getAllAlerts.results }}

Looking at the documentation, I cannot see a way to do it easily, and the python provider cannot consume the entire element due to it being wrapped in AlertDto:

[
  {
    "test": "[AlertDto(id='1dfd933750c16c1edf3a126518dcafc9', name='NetworkLatencyIsHighAgain', status='firing', severity='info', lastReceived='2025-09-25T12:57:38.135Z', firingStartTime='2025-09-25T10:40:10.911Z', firingStartTimeSinceLastResolved='2025-09-25T10:40:10.911Z', firingCounter=4, environment='unknown', isFullDuplicate=False, isPartialDuplicate=True, duplicateReason=None, service=None, source=['grafana'], apiKeyRef=None, message=None, description='Network Latency High on srv1-eu2-prod', description_format=None, pushed=True, event_id='a1686ed7-cc9c-4cff-b45d-2108d4b90044', url=None, imageUrl=None, labels={'severity': 'info', 'monitor': 'router2'}, fingerprint='57b8c891087451648c05eeec91a677d9b14f6570eb07347f21a798cd905f60d3', deleted=False, dismissUntil='', dismissed=False, assignee=None, providerId=None, providerType='grafana', note=None, startedAt='2025-09-25 10:40:11.001000', isNoisy=False, enriched_fields=['dismissed', 'dismissUntil'], incident=None, valueString=None, monitor='router2', alert_hash='acde1161504192337e5f22067df68aaa498712d71370075688851deaba5d0fe5', firstTimestamp='2025-09-25 10:40:11.001000', panelUrl=None, dashboardUrl=None, annotations={'summary': 'Network Latency High on srv1-eu2-prod'})]"
  }
]

[dosubot[bot]]

Hi @knownasred! I'm Dosu and I’m helping the keep team.

There isn’t a native “map” or aggregation operation in Keep workflows that lets you combine all elements of an array (like AlertDto objects) into a single variable for use in one action. The closest built-in feature is foreach, which processes each element individually and triggers the action multiple times—not what you’re after for a single notification docs.

The Python provider can help with custom aggregation, but it receives AlertDto objects as string representations, so direct manipulation is limited unless you handle serialization yourself python provider code. A common workaround is to use a Python step to extract the fields you need from each alert, build a summary (like a list of dicts or a formatted string), and then pass that to your action for a single execution discussion.

If you want to aggregate alert data, you’ll need to write Python code that parses the stringified AlertDto objects, extracts the relevant info, and combines it into your desired format. Then, reference the output variable in your action’s message. There’s no built-in YAML syntax for this, but it’s doable with a custom Python step.

Let me know if you want an example of how to structure the Python code for this!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}