# Agrregation on multiple input in elasticsearch

**URL:** <https://discuss.elastic.co/t/agrregation-on-multiple-input-in-elasticsearch/62825>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 12, 2016, 3:21pm UTC](https://discuss.elastic.co/t/agrregation-on-multiple-input-in-elasticsearch/62825 "2016-10-12T15:21:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![SravanTurbo](https://avatars.discourse-cdn.com/v4/letter/s/a88e57/32.png) [@SravanTurbo](https://discuss.elastic.co/u/SravanTurbo)\
**Post date:** [October 12, 2016, 3:21pm UTC](https://discuss.elastic.co/t/agrregation-on-multiple-input-in-elasticsearch/62825/1 "2016-10-12T15:21:18Z")

</div>

**Elasticsearch version:** 2.4.1

**Plugins installed:** watcher

**Description of the problem:**

I am monitoring the input sources and trying to output the sources which are active.

I have 3 input sources ["192.168.48.8", "192.168.30.150", "192.168.190.8"], out of which "192.168.190.8" is inactive,

I was able to get the name of active sources in my alert.

**Watch Output:**

"Input Sources: {0=192.168.48.8, 1=192.168.30.150, 2=192.168.190.8}

Some sources are not contributing;

Active Sources: {0={doc\_count=52729, key=192.168.30.150}, 1={doc\_count=40149, key=192.168.48.8}}"

**Doubt:**

Is there a way to notify the names of inactive sources (may be by subtracting the aggregated active sources from Input sources ), below is the watch implemented.

Thanks in advance!!!

**Watch:**

```
"trigger"
  {
    "schedule" : { "interval" : "1m" }
  },
  "input" : {
    "chain": {
      "inputs": [
        {
          "first": {
            "simple" : {
              "Input_hosts" : ["192.168.48.8", "192.168.30.150", "192.168.190.8"]
            }
          }
        },
        {
          "second": {
            "search" : {
              "request" : {
                "indices" : ["firewalls"],
                "body" : {
                  "query" : {
                    "bool": {
                      "must": [
                {
                          "range": {
                            "@timestamp": {
                              "gte": "now-4d"
                            }
                          }
                        },
                { "bool": {
                        "should": [
                              { "bool": { "must_not": { "match" : {"host": "192.168.190.8"}}}}, 
                              { "bool": { "must_not": {"match" : {"host": "192.168.48.8"}}}},
                              { "bool": { "must_not": {"match" : {"host": "192.168.30.150"}}}}]
                          }           
                        }
                      ]
                    }   
                  },
                  "size": 0,
                  "aggregations": {
                            'hosts': { "terms": { "field": "host" } }
                  }     
                }
              }
            }
          }
        }
      ]
    } 
  },
  "condition" : {
    "compare" : { "ctx.payload.second.hits.total" : { "gt" : 0 }} 
  },
  "throttle_period" : "12h",
  "actions" : {
    "send_email" : {     
      "email" : {
        "to" : ["abc@def.com"],
        "subject" : "{{ctx.watch_id}}",
        "body" : "Input Sources: {{ctx.payload.first.Input_hosts}}\n\nSome sources are not contributing;\n\nActive Sources: {{ctx.payload.second.aggregations.hosts.buckets}}",
        "attach_data" : true
      }
    }
  }
}'
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 13, 2016, 12:56pm UTC](https://discuss.elastic.co/t/agrregation-on-multiple-input-in-elasticsearch/62825/2 "2016-10-13T12:56:24Z")

</div>

Hey,

you could use a script transform to change the payload using a script and do that mentioned substraction.

See [the transform script documentation](https://www.elastic.co/guide/en/watcher/2.4/transform.html#transform-script) for more.

--Alex

---

<div class="post-metadata">

**Author:** ![SravanTurbo](https://avatars.discourse-cdn.com/v4/letter/s/a88e57/32.png) [@SravanTurbo](https://discuss.elastic.co/u/SravanTurbo)\
**Post date:** [October 13, 2016, 3:46pm UTC](https://discuss.elastic.co/t/agrregation-on-multiple-input-in-elasticsearch/62825/3 "2016-10-13T15:46:34Z")

</div>

Can you please suggest me how to script it

Thanks,  
Sravan

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 14, 2016, 7:22am UTC](https://discuss.elastic.co/t/agrregation-on-multiple-input-in-elasticsearch/62825/4 "2016-10-14T07:22:41Z")

</div>

Hey.

if you are on groovy, you can just use the `-` operator to substract lists. See this snippet

```auto
 a = [1, 2, 3]
b = [[key:"foo", value: 1], [key:"bar", value:2], ["key":"baz", value: 4]]

a - b*.value
===> [3]

```

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:42pm UTC](https://discuss.elastic.co/t/agrregation-on-multiple-input-in-elasticsearch/62825/5 "2017-07-06T13:42:34Z")

</div>