# Accessing nested aggregations in a watcher's action
**URL:** https://discuss.elastic.co/t/accessing-nested-aggregations-in-a-watchers-action/348592
**Category:** Kibana
**Created:** [December 4, 2023, 7:17pm UTC](https://discuss.elastic.co/t/accessing-nested-aggregations-in-a-watchers-action/348592 "2023-12-04T19:17:59Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Wave](https://discuss.elastic.co/u/Wave)
#### Post date: [December 4, 2023, 7:17pm UTC](https://discuss.elastic.co/t/accessing-nested-aggregations-in-a-watchers-action/348592/1 "2023-12-04T19:17:59Z")
This isn't a question, but just wanted to share something I've learned. There are similar posts that talk about [nested aggregations](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-nested-aggregation.html), but nothing that quite explained what I was looking for.
Creating advanced watchers in Kibana is a crucial tool for promptly identifying when specific complex conditions occur.
A watcher can be configured to use [mustache syntax](https://www.elastic.co/guide/en/elasticsearch/reference/current/how-watcher-works.html#templates) to iterate over arrays. This is especially handy when you want to work with nested aggregations.
For example using this aggregation query part:
```auto
"aggs": {
"username": {
"terms": {
"field": "service.user_name",
"size": 25
},
"aggs": {
"top_froms": {
"top_hits": {
"_source": {
"includes": [
"transaction.from"
]
},
"size": 1
}
}
}
}
}
```
Could return something like this:
```auto
"aggregations": {
"username": {
"buckets": [
{
"key": "example_name_1",
"doc_count": 3,
"top_froms": {
"hits": {
"hits": [
{
"_source": {
"transaction": {
"from": "88888888"
}
}
}
]
}
}
},
{
"key": "example_name_2",
"doc_count": 2,
"top_froms": {
"hits": {
"hits": [
{
"_source": {
"transaction": {
"from": "99999999"
}
}
}
]
}
}
}
]
}
}
```
Which could then be accessed in a watcher action with:
```auto
{{#ctx.payload.aggregations.username.buckets}}from:{{#top_froms.hits.hits}}{{_source.transaction.from}}{{/top_froms.hits.hits}},count: {{doc_count}},username:{{key}}{{/ctx.payload.aggregations.username.buckets}}
```
Which would display the following:
```auto
from:88888888,count:3,username:example_name_1
from:99999999,count:2,username:example_name_2
```
Something to keep in mind is the nested mustache syntax (top\_from.hits.hits) is relative to the parent (ctx.payload.aggregations.username.buckets).
Hopefully this will be helpful to others.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2024, 7:18pm UTC](https://discuss.elastic.co/t/accessing-nested-aggregations-in-a-watchers-action/348592/2 "2024-01-01T19:18:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.