# Alert Rule with DSL finding if most recent value has a true property

**URL:** <https://discuss.elastic.co/t/alert-rule-with-dsl-finding-if-most-recent-value-has-a-true-property/369168>\
**Category:** Elasticsearch\
**Created:** [October 21, 2024, 4:20pm UTC](https://discuss.elastic.co/t/alert-rule-with-dsl-finding-if-most-recent-value-has-a-true-property/369168 "2024-10-21T16:20:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeffabar](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jeffabar](https://discuss.elastic.co/u/jeffabar)\
**Post date:** [October 21, 2024, 4:20pm UTC](https://discuss.elastic.co/t/alert-rule-with-dsl-finding-if-most-recent-value-has-a-true-property/369168/1 "2024-10-21T16:20:23Z")

</div>

I am looking to build an alert rule where if the latest record for a module has an unexpected\_state == true trigger the rule and if the most recent state is not unexpected\_state == true generate no record which will allow the alert to self recover.

This is the DSL I have so far:

```GET
  {
    "size": 0,
    "aggs": {
      "modules": {
        "terms": {
          "field": "tcx_sys_beacons.module",
          "size": 1000 // Adjust size as necessary
        },
        "aggs": {
          "latest_record": {
            "top_hits": {
              "sort": [
                {
                  "tcx_sys_time": {
                    "order": "desc"
                  }
                }
              ],
              "_source" : { "includes": ["tcx_sys_time", "tcx_sys_beacons.beacon_unexpected_state"]},
              "size": 1
            }
          },
          "unexpected_state": {
            "bucket_selector": {
              "buckets_path": {
                "latestState": "latest_record[_source.tcx_sys_beacons.beacon_unexpected_state]"
              },
              "script": "params.latestState == true"
            }
          }
        }
    }
}}

```

However it generates this error which I have been unable to resolve:

```auto
{
  "error": {
    "root_cause": [],
    "type": "search_phase_execution_exception",
    "reason": "",
    "phase": "rank-feature",
    "grouped": true,
    "failed_shards": [],
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "buckets_path must reference either a number value or a single value numeric metric aggregation, got: [LinkedHashMap] at aggregation [latest_record]"
    }
  },
  "status": 400
}

```

Any help would be greatly appreciated! --Jeff

---

<div class="post-metadata">

**Author:** ![jeffabar](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jeffabar](https://discuss.elastic.co/u/jeffabar)\
**Post date:** [October 23, 2024, 4:24pm UTC](https://discuss.elastic.co/t/alert-rule-with-dsl-finding-if-most-recent-value-has-a-true-property/369168/2 "2024-10-23T16:24:59Z")

</div>

I changed the fields to not have a "." in their name and I also changed the filed of tcx\_sys\_beacons.beacon\_unexpected\_state to be an integer of either 0 or 1. This allowed the query to work.

Is there a way to write the query where the "." does not cause errors?

We have a number of fields including ECS fields that have "." in their name so knowing how to work around this would be very useful.