# Access nested aggregations in watcher's condition

**URL:** <https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [August 11, 2020, 1:16pm UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555 "2020-08-11T13:16:54Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [August 11, 2020, 1:16pm UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/1 "2020-08-11T13:16:54Z")

</div>

Hello,

I have the following watcher alert that calculates the ratio of orders/searches for each of my customers and returns it with an email.

```
{
  "trigger": {
    "schedule": {
      "cron": "0 0/2 * 1/1 * ? *"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "webshop-events-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [],
              "filter": [
                {
                  "match_all": {}
                },
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-2400h",
                      "to": "now"
                    }
                  }
                }
              ],
              "should": [],
              "must_not": [
                {
                  "bool": {
                    "should": [
                      {
                        "match_phrase": {
                          "customer_nr": "1234"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "471118"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "4409412"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "5136291"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "9208797"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "471696"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "4409849"
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ]
            }
          },
          "aggs": {
            "convratepercustomeraccount": {
              "terms": {
                "field": "customer_nr",
                "size": 10000
              },
              "aggs": {
                "total_orders": {
                  "filter": {
                    "term": {
                      "order_type.keyword": "ORDER"
                    }
                  }
                },
                "total_searches": {
                  "filter": {
                    "terms": {
                      "event_type.keyword": [
                        "fulltextsearch",
                        "fahrzeugsuche",
                        "teilesuche"
                      ]
                    }
                  }
                },
                "output": {
                  "bucket_script": {
                    "buckets_path": {
                      "totalorders": "total_orders._count",
                      "totalsearches": "total_searches._count"
                    },
                    "script": "(params.totalorders / params.totalsearches) * 100"
                  }
                },
                "ratio_bucket_sort": {
                  "bucket_sort": {
                    "size": 20,
                    "sort": [
                      {
                        "output": {
                          "order": "desc"
                        }
                      }
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggs.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
      "lang": "painless",
      "params": {
        "threshold": 5
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "to": [
          "alexandros.ananikidis@sag-ag.ch"
        ],
        "subject": "Customer Conversion rate",
        "body": {
          "html": "<b>Conversion Rate per Customer:</b> <ul>{{#ctx.payload.aggregations.convratepercustomeraccount.buckets}}<li><b>Customer:</b> {{key}}&ensp;<b>Rate:</b> {{output.value}}%</li>{{/ctx.payload.aggregations.convratepercustomeraccount.buckets}}</ul>"
        }
      }
    }
  }
}

```

It works fine except the part where i put the condition section which is the following:

```
 "condition": {
    "script": {
      "source": "return ctx.payload.aggs.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
      "lang": "painless",
      "params": {
        "threshold": 5
      }
    }
  }

```

The error that i get is the following because of my condition:

```
"exception": {
    "type": "script_exception",
    "reason": "runtime error",
    "script_stack": [
      "return ctx.payload.aggs.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
      " ^---- HERE"
    ],
    "script": "return ctx.payload.aggs.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
    "lang": "painless",
    "position": {
      "offset": 23,
      "start": 0,
      "end": 100
    },
    "caused_by": {
      "type": "null_pointer_exception",
      "reason": "Cannot invoke \"Object.getClass()\" because \"callArgs[0]\" is null",

```

How can i change my condition so i can make it access that nested field without throwing an exception?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 12, 2020, 8:20am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/2 "2020-08-12T08:20:54Z")

</div>

please check the response of that search, I suppose the field is named `aggregations`

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [August 12, 2020, 8:52am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/3 "2020-08-12T08:52:23Z")

</div>

Hello Alex,

My watcher code is like that:

```
{
  "trigger": {
    "schedule": {
      "cron": "0 0/2 * 1/1 * ? *"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "webshop-events-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [],
              "filter": [
                {
                  "match_all": {}
                },
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-2400h",
                      "to": "now"
                    }
                  }
                }
              ],
              "should": [],
              "must_not": [
                {
                  "bool": {
                    "should": [
                      {
                        "match_phrase": {
                          "customer_nr": "1234"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "471118"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "4409412"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "5136291"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "9208797"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "471696"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "4409849"
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ]
            }
          },
          "aggregations": {
            "convratepercustomeraccount": {
              "terms": {
                "field": "customer_nr",
                "size": 10000
              },
              "aggregations": {
                "total_orders": {
                  "filter": {
                    "term": {
                      "order_type.keyword": "ORDER"
                    }
                  }
                },
                "total_searches": {
                  "filter": {
                    "terms": {
                      "event_type.keyword": [
                        "fulltextsearch",
                        "fahrzeugsuche",
                        "teilesuche"
                      ]
                    }
                  }
                },
                "output": {
                  "bucket_script": {
                    "buckets_path": {
                      "totalorders": "total_orders._count",
                      "totalsearches": "total_searches._count"
                    },
                    "script": "(params.totalorders / params.totalsearches) * 100"
                  }
                },
                "ratio_bucket_sort": {
                  "bucket_sort": {
                    "size": 20,
                    "sort": [
                      {
                        "output": {
                          "order": "desc"
                        }
                      }
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
      "lang": "painless",
      "params": {
        "threshold": 5
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "to": [
          "alexandros.ananikidis@sag-ag.ch"
        ],
        "subject": "Customer Conversion rate",
        "body": {
          "html": "<b>Conversion Rate per Customer:</b> <ul>{{#ctx.payload.aggregations.convratepercustomeraccount.buckets}}<li><b>Customer:</b> {{key}}&ensp;<b>Rate:</b> {{output.value}}%</li>{{/ctx.payload.aggregations.convratepercustomeraccount.buckets}}</ul>"
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [August 12, 2020, 8:56am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/4 "2020-08-12T08:56:07Z")

</div>

and the response that you asked is:

"exception": {  
"type": "script\_exception",  
"reason": "runtime error",  
"script\_stack": [  
"return ctx.payload.aggregations.convratepercustomeraccount.buckets.total\_orders.doc\_count \> params.threshold",  
" ^---- HERE"  
],  
"script": "return ctx.payload.aggregations.convratepercustomeraccount.buckets.total\_orders.doc\_count \> params.threshold",  
"lang": "painless",  
"position": {  
"offset": 66,  
"start": 0,  
"end": 108  
},  
"caused\_by": {  
"type": "illegal\_argument\_exception",  
"reason": "Illegal list shortcut value [total\_orders].",  
"stack\_trace": "java.lang.IllegalArgumentException: Illegal list shortcut value [total\_orders].\n\tat org.elasticsearch.painless.Def.lookupGetter(Def.java:392)\n\tat org.elasticsearch.painless.DefBootstrap$PIC.lookup(DefBootstrap.java:153)\n\tat org.elasticsearch.painless.DefBootstrap$PIC.fallback(DefBootstrap.java:207)\n\tat org.elasticsearch.painless.PainlessScript$Script.execute(return ctx.payload.aggregations.convratepercustomeraccount.buckets.total\_orders.doc\_count \> params.threshold:67)\n\tat org.elasticsearch.xpack.watcher.condition.ScriptCondition.doExecute(ScriptCondition.java:60)\n\tat org.elasticsearch.xpack.watcher.condition.ScriptCondition.execute(ScriptCondition.java:55)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.executeInner(ExecutionService.java:512)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.execute(ExecutionService.java:319)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.lambda$executeAsync$5(ExecutionService.java:420)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService$WatchExecutionTask.run(ExecutionService.java:626)\n\tat org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:636)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)\n\tat java.base/java.lang.Thread.run(Thread.java:832)\n"  
},  
"stack\_trace": "ScriptException[runtime error]; nested: IllegalArgumentException[Illegal list shortcut value [total\_orders].];\n\tat org.elasticsearch.painless.PainlessScript.convertToScriptException(PainlessScript.java:96)\n\tat org.elasticsearch.painless.PainlessScript$Script.execute(return ctx.payload.aggregations.convratepercustomeraccount.buckets.total\_orders.doc\_count \> params.threshold:99)\n\tat org.elasticsearch.xpack.watcher.condition.ScriptCondition.doExecute(ScriptCondition.java:60)\n\tat org.elasticsearch.xpack.watcher.condition.ScriptCondition.execute(ScriptCondition.java:55)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.executeInner(ExecutionService.java:512)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.execute(ExecutionService.java:319)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.lambda$executeAsync$5(ExecutionService.java:420)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService$WatchExecutionTask.run(ExecutionService.java:626)\n\tat org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:636)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)\n\tat java.base/java.lang.Thread.run(Thread.java:832)\nCaused by: java.lang.IllegalArgumentException: Illegal list shortcut value [total\_orders].\n\tat org.elasticsearch.painless.Def.lookupGetter(Def.java:392)\n\tat org.elasticsearch.painless.DefBootstrap$PIC.lookup(DefBootstrap.java:153)\n\tat org.elasticsearch.painless.DefBootstrap$PIC.fallback(DefBootstrap.java:207)\n\tat org.elasticsearch.painless.PainlessScript$Script.execute(return ctx.payload.aggregations.convratepercustomeraccount.buckets.total\_orders.doc\_count \> params.threshold:67)\n\t... 10 more\n"  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 12, 2020, 9:06am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/5 "2020-08-12T09:06:42Z")

</div>

This is not too helpful, as one cannot see the search response. Using the [execute watch API](https://www.elastic.co/guide/en/elasticsearch/reference/7.8/watcher-api-execute-watch.html) and sharing its output might be much more helpful.

My assumption here is that `ctx.payload.aggregations.convratepercustomeraccount.buckets` is an array, so that you have to specify the array position in there.

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [August 12, 2020, 9:24am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/6 "2020-08-12T09:24:57Z")

</div>

Hello alex,

Id doesnt let me send you the response because of message size limit.

i will send it in 2 parts

Part 1:

```
{
  "watch_id": "conversion_report2",
  "node": "IQhDHLCVRXCAKsejaLyT-w",
  "state": "failed",
  "user": "ext_anan",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2020-08-12T08:45:18.179Z"
    },
    "actions": {
      "send_email": {
        "ack": {
          "timestamp": "2020-08-12T08:45:18.179Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "failed",
    "version": -1
  },
  "trigger_event": {
    "type": "schedule",
    "triggered_time": "2020-08-12T09:20:00.060Z",
    "schedule": {
      "scheduled_time": "2020-08-12T09:20:00.000Z"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "webshop-events-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [],
              "filter": [
                {
                  "match_all": {}
                },
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-2400h",
                      "to": "now"
                    }
                  }
                }
              ],
              "should": [],
              "must_not": [
                {
                  "bool": {
                    "should": [
                      {
                        "match_phrase": {
                          "customer_nr": "1234"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "471118"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "4409412"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "5136291"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "9208797"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "471696"
                        }
                      },
                      {
                        "match_phrase": {
                          "customer_nr": "4409849"
                        }
                      }
                    ],
                    "minimum_should_match": 1
                  }
                }
              ]
            }
          },
          "aggregations": {
            "convratepercustomeraccount": {
              "terms": {
                "field": "customer_nr",
                "size": 10000
              },
              "aggregations": {
                "total_orders": {
                  "filter": {
                    "term": {
                      "order_type.keyword": "ORDER"
                    }
                  }
                },
                "total_searches": {
                  "filter": {
                    "terms": {
                      "event_type.keyword": [
                        "fulltextsearch",
                        "fahrzeugsuche",
                        "teilesuche"
                      ]
                    }
                  }
                },
                "output": {
                  "bucket_script": {
                    "buckets_path": {
                      "totalorders": "total_orders._count",
                      "totalsearches": "total_searches._count"
                    },
                    "script": "(params.totalorders / params.totalsearches) * 100"
                  }
                },
                "ratio_bucket_sort": {
                  "bucket_sort": {
                    "size": 20,
                    "sort": [
                      {
                        "output": {
                          "order": "desc"
                        }
                      }
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
      "lang": "painless",
      "params": {
        "threshold": 5
      }
    }
  },
  "metadata": {
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2020-08-12T09:20:00.060Z",
    "execution_duration": 2558,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 3,
          "failed": 0,
          "successful": 3,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 10000,
          "max_score": null
        },
        "took": 2556,
        "timed_out": false,
        "aggregations": {
          "convratepercustomeraccount": {
            "doc_count_error_upper_bound": 92,
            "sum_other_doc_count": 1397343,
            "buckets": [
              {
                "output": {
                  "value": 209.0909090909091
                },
                "doc_count": 289,
                "total_orders": {
                  "doc_count": 23
                },
                "key": 8048,
                "total_searches": {
                  "doc_count": 11
                }
              },
              {
                "output": {
                  "value": 111.67883211678833
                },
                "doc_count": 1317,
                "total_orders": {
                  "doc_count": 153
                },
                "key": 3646,
                "total_searches": {
                  "doc_count": 137
                }
              },
              {
                "output": {
                  "value": 108
                },
                "doc_count": 271,
                "total_orders": {
                  "doc_count": 27
                },
                "key": 457869,
                "total_searches": {
                  "doc_count": 25
                }
              },
              {
                "output": {
                  "value": 100
                },
                "doc_count": 261,
                "total_orders": {
                  "doc_count": 6
                },
                "key": 467971,
                "total_searches": {
                  "doc_count": 6
                }
              },
              {
                "output": {
                  "value": 98.64864864864865
                },
                "doc_count": 594,
                "total_orders": {
                  "doc_count": 73
                },
                "key": 460230,
                "total_searches": {
                  "doc_count": 74
                }
              },
              {
                "output": {
                  "value": 93.10344827586206
                },
                "doc_count": 315,
                "total_orders": {
                  "doc_count": 27
                },
                "key": 19361,
                "total_searches": {
                  "doc_count": 29
                }
              },
              {
                "output": {
                  "value": 89.58333333333334
                },
                "doc_count": 399,
                "total_orders": {
                  "doc_count": 43
                },
                "key": 10903,
                "total_searches": {
                  "doc_count": 48
                }
              },
              {
                "output": {
                  "value": 86.95652173913044
                },
                "doc_count": 318,
                "total_orders": {
                  "doc_count": 40
                },
                "key": 17566,
                "total_searches": {
                  "doc_count": 46
                }
              },
              {
                "output": {
                  "value": 86.36363636363636
                },
                "doc_count": 246,
                "total_orders": {
                  "doc_count": 19
                },
                "key": 7485,
                "total_searches": {
                  "doc_count": 22
                }
              },
              {
                "output": {
                  "value": 85.8974358974359
                },
                "doc_count": 738,
                "total_orders": {
                  "doc_count": 67
                },
                "key": 4106556,
                "total_searches": {
                  "doc_count": 78
                }
              },
```

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [August 12, 2020, 9:25am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/7 "2020-08-12T09:25:43Z")

</div>

part 2:

```
 {
                "output": {
                  "value": 82.14285714285714
                },
                "doc_count": 533,
                "total_orders": {
                  "doc_count": 69
                },
                "key": 4121886,
                "total_searches": {
                  "doc_count": 84
                }
              },
              {
                "output": {
                  "value": 78.96995708154506
                },
                "doc_count": 1979,
                "total_orders": {
                  "doc_count": 184
                },
                "key": 37772,
                "total_searches": {
                  "doc_count": 233
                }
              },
              {
                "output": {
                  "value": 77.96610169491525
                },
                "doc_count": 454,
                "total_orders": {
                  "doc_count": 46
                },
                "key": 107577,
                "total_searches": {
                  "doc_count": 59
                }
              },
              {
                "output": {
                  "value": 77.77777777777779
                },
                "doc_count": 316,
                "total_orders": {
                  "doc_count": 21
                },
                "key": 19095,
                "total_searches": {
                  "doc_count": 27
                }
              },
              {
                "output": {
                  "value": 77.66990291262135
                },
                "doc_count": 927,
                "total_orders": {
                  "doc_count": 80
                },
                "key": 151259,
                "total_searches": {
                  "doc_count": 103
                }
              },
              {
                "output": {
                  "value": 76.81159420289855
                },
                "doc_count": 581,
                "total_orders": {
                  "doc_count": 53
                },
                "key": 240,
                "total_searches": {
                  "doc_count": 69
                }
              },
              {
                "output": {
                  "value": 75
                },
                "doc_count": 441,
                "total_orders": {
                  "doc_count": 63
                },
                "key": 1401088,
                "total_searches": {
                  "doc_count": 84
                }
              },
              {
                "output": {
                  "value": 74.6268656716418
                },
                "doc_count": 636,
                "total_orders": {
                  "doc_count": 50
                },
                "key": 1121419,
                "total_searches": {
                  "doc_count": 67
                }
              },
              {
                "output": {
                  "value": 74.35897435897436
                },
                "doc_count": 429,
                "total_orders": {
                  "doc_count": 29
                },
                "key": 460202,
                "total_searches": {
                  "doc_count": 39
                }
              },
              {
                "output": {
                  "value": 74.3421052631579
                },
                "doc_count": 1176,
                "total_orders": {
                  "doc_count": 113
                },
                "key": 8100,
                "total_searches": {
                  "doc_count": 152
                }
              }
            ]
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "webshop-events-*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "must": [],
                "filter": [
                  {
                    "match_all": {}
                  },
                  {
                    "range": {
                      "@timestamp": {
                        "from": "now-2400h",
                        "to": "now"
                      }
                    }
                  }
                ],
                "should": [],
                "must_not": [
                  {
                    "bool": {
                      "should": [
                        {
                          "match_phrase": {
                            "customer_nr": "1234"
                          }
                        },
                        {
                          "match_phrase": {
                            "customer_nr": "471118"
                          }
                        },
                        {
                          "match_phrase": {
                            "customer_nr": "4409412"
                          }
                        },
                        {
                          "match_phrase": {
                            "customer_nr": "5136291"
                          }
                        },
                        {
                          "match_phrase": {
                            "customer_nr": "9208797"
                          }
                        },
                        {
                          "match_phrase": {
                            "customer_nr": "471696"
                          }
                        },
                        {
                          "match_phrase": {
                            "customer_nr": "4409849"
                          }
                        }
                      ],
                      "minimum_should_match": 1
                    }
                  }
                ]
              }
            },
            "aggregations": {
              "convratepercustomeraccount": {
                "terms": {
                  "field": "customer_nr",
                  "size": 10000
                },
                "aggregations": {
                  "total_orders": {
                    "filter": {
                      "term": {
                        "order_type.keyword": "ORDER"
                      }
                    }
                  },
                  "total_searches": {
                    "filter": {
                      "terms": {
                        "event_type.keyword": [
                          "fulltextsearch",
                          "fahrzeugsuche",
                          "teilesuche"
                        ]
                      }
                    }
                  },
                  "output": {
                    "bucket_script": {
                      "buckets_path": {
                        "totalorders": "total_orders._count",
                        "totalsearches": "total_searches._count"
                      },
                      "script": "(params.totalorders / params.totalsearches) * 100"
                    }
                  },
                  "ratio_bucket_sort": {
                    "bucket_sort": {
                      "size": 20,
                      "sort": [
                        {
                          "output": {
                            "order": "desc"
                          }
                        }
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "actions": []
  },
  "exception": {
    "type": "script_exception",
    "reason": "runtime error",
    "script_stack": [
      "return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
      " ^---- HERE"
    ],
    "script": "return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
    "lang": "painless",
    "position": {
      "offset": 66,
      "start": 0,
      "end": 108
    },
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "Illegal list shortcut value [total_orders].",
      "stack_trace": "java.lang.IllegalArgumentException: Illegal list shortcut value [total_orders].\n\tat org.elasticsearch.painless.Def.lookupGetter(Def.java:392)\n\tat org.elasticsearch.painless.DefBootstrap$PIC.lookup(DefBootstrap.java:153)\n\tat org.elasticsearch.painless.DefBootstrap$PIC.fallback(DefBootstrap.java:207)\n\tat org.elasticsearch.painless.PainlessScript$Script.execute(return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold:67)\n\tat org.elasticsearch.xpack.watcher.condition.ScriptCondition.doExecute(ScriptCondition.java:60)\n\tat org.elasticsearch.xpack.watcher.condition.ScriptCondition.execute(ScriptCondition.java:55)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.executeInner(ExecutionService.java:512)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.execute(ExecutionService.java:319)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.lambda$executeAsync$5(ExecutionService.java:420)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService$WatchExecutionTask.run(ExecutionService.java:626)\n\tat org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:636)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)\n\tat java.base/java.lang.Thread.run(Thread.java:832)\n"
    },
    "stack_trace": "ScriptException[runtime error]; nested: IllegalArgumentException[Illegal list shortcut value [total_orders].];\n\tat org.elasticsearch.painless.PainlessScript.convertToScriptException(PainlessScript.java:96)\n\tat org.elasticsearch.painless.PainlessScript$Script.execute(return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold:99)\n\tat org.elasticsearch.xpack.watcher.condition.ScriptCondition.doExecute(ScriptCondition.java:60)\n\tat org.elasticsearch.xpack.watcher.condition.ScriptCondition.execute(ScriptCondition.java:55)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.executeInner(ExecutionService.java:512)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.execute(ExecutionService.java:319)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService.lambda$executeAsync$5(ExecutionService.java:420)\n\tat org.elasticsearch.xpack.watcher.execution.ExecutionService$WatchExecutionTask.run(ExecutionService.java:626)\n\tat org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:636)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)\n\tat java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)\n\tat java.base/java.lang.Thread.run(Thread.java:832)\nCaused by: java.lang.IllegalArgumentException: Illegal list shortcut value [total_orders].\n\tat org.elasticsearch.painless.Def.lookupGetter(Def.java:392)\n\tat org.elasticsearch.painless.DefBootstrap$PIC.lookup(DefBootstrap.java:153)\n\tat org.elasticsearch.painless.DefBootstrap$PIC.fallback(DefBootstrap.java:207)\n\tat org.elasticsearch.painless.PainlessScript$Script.execute(return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold:67)\n\t... 10 more\n"
  }
}
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 12, 2020, 10:01am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/8 "2020-08-12T10:01:40Z")

</div>

You can also use a gist instead for example.

My above assumption is the cause of your issue take a look at the search response in the JSON in order to figure out the structure.

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [August 12, 2020, 10:30am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/9 "2020-08-12T10:30:46Z")

</div>

It is almost clear that it has problem in my condition in order to access total orders because i have aggregation within aggregation it mentions that here in the response yes:

```
return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
      " ^---- HERE"

```

and also here:

`"stack_trace": "ScriptException[runtime error]; nested: IllegalArgumentException[Illegal list shortcut value [total_orders].]`

I can understand that.

My problem is that i dont know how to change my condition in order to make it access that fields:

How to change that part:

```
 "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.convratepercustomeraccount.buckets.total_orders.doc_count > params.threshold",
      "lang": "painless",
      "params": {
        "threshold": 5
      }
    }
  }

```

Can you provide me a solution on how to change my condition?

Thank you a lot in advance  
Alexandros

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 12, 2020, 11:24am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/10 "2020-08-12T11:24:33Z")

</div>

that would be by specifying an element for the array like `buckets.get(0)`

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [August 12, 2020, 11:37am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/11 "2020-08-12T11:37:58Z")

</div>

but i want all elements not just one ...

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 12, 2020, 12:37pm UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/12 "2020-08-12T12:37:36Z")

</div>

then you need to loop through them, for example with a for-loop

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [August 12, 2020, 12:48pm UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/13 "2020-08-12T12:48:13Z")

</div>

Hello Alex,

Can you provide me that piece of code or send me a link concerning these loops in order to study them?

It doesnt exist in the Elastic documentation i believe that case with 2 aggragations one inside the other so icant figure it out myself 🙂

Thank you a lot in advance

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 13, 2020, 7:35am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/14 "2020-08-13T07:35:48Z")

</div>

There is a neat [examples repo](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches) with sample watches. IIRC the first watch about cpu iowait already checks for multi level aggregations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 10, 2020, 7:35am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555/15 "2020-09-10T07:35:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.