Rename match and aggs fields

core/lib/rules.py

@@ -379,7 +379,8 @@ class NotificationRuleData(object):
             pass
 
         # We hit the return above if we don't need to notify
-        meta["matched"] = self.format_matched(message)
+        if "matched" not in meta:
+            meta["matched"] = self.format_matched(message)
         if "aggs" in meta:
             aggs_formatted = self.format_aggs(meta["aggs"])
             if aggs_formatted:
@@ -415,9 +416,13 @@ class NotificationRuleData(object):
             pass
 
         # We hit the return above if we don't need to notify
-        meta["matched"] = self.format_matched(message)
+        if "matched" not in meta:
+            meta["matched"] = self.format_matched(message)
         if "aggs" in meta:
-            meta["format_aggs"] = self.format_aggs(meta["aggs"])
+            aggs_formatted = self.format_aggs(meta["aggs"])
+            if aggs_formatted:
+                meta["matched_aggs"] = aggs_formatted
+
         rule_notify(self.object, index, message, meta)
         self.store_match(index, message)
         self.ingest_matches_sync(index, message, meta, mode)