# Chain input Watcher multi result

**URL:** <https://discuss.elastic.co/t/chain-input-watcher-multi-result/213712>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 3, 2020, 1:38pm UTC](https://discuss.elastic.co/t/chain-input-watcher-multi-result/213712 "2020-01-03T13:38:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [January 3, 2020, 1:38pm UTC](https://discuss.elastic.co/t/chain-input-watcher-multi-result/213712/1 "2020-01-03T13:38:43Z")

</div>

Hi,

I am really struggling to implement the following; I need a watcher which determines if for a username 2 different events occur after each other in a 24h window.

## Requirements

**First event** :

```auto
{
    "@version": "1",
    "useraudit": {
      "datetime": "10-12-2019 11:07:35.843",
      "message": "role admin granted for jane by system",
      "level": "INFO",
      "actor": "system",
      "entity": "jane",
      "security": true
    },
    "tags": [
      "useraudit",
      "system",
    ],
    "logevent": "{\"datetime\":\"10-12-2019 11:07:35.843\",\"message\":\"role admin granted for jane by system\",\"entity\":\"jane\",\"actor\":\"system\",\"level\":\"INFO\",\"security\":true}",
    "@timestamp": "2019-12-10T11:43:09.341Z",
    "id": 850
}

```

So the watcher should look for these events, and then for every results, determine if for the entity (jane) the second event occured in 24hours since the first event.

**Second event:**

```auto
{
    "@version": "1",
    "useraudit": {
      "datetime": "10-12-2019 13:07:35.843",
      "message": "role admin revoked for jane by system",
      "level": "INFO",
      "actor": "system",
      "entity": "jane",
      "security": true
    },
    "tags": [
      "useraudit",
      "system",
    ],
    "logevent": "{\"datetime\":\"10-12-2019 13:07:35.843\",\"message\":\"role admin revoked for jane by system\",\"entity\":\"jane\",\"actor\":\"system\",\"level\":\"INFO\",\"security\":true}",
    "@timestamp": "2019-12-10T13:43:09.341Z",
    "id": 851
}

```

## Watcher

The watcher I have uses a chain input, search input for each query.

```auto
{
  "trigger": {
    "schedule": {
      "interval": "30s"
    }
  },
  "input": {
    "chain": {
      "inputs": [
        {
          "granting": {
            "search": {
              "request": {
                "indices": ["filebeat-*"],
                "body": {
                  "size": 2,
                  "query": {
                    "bool": {
                      "must": [
                          {
                              "range": {
                                  "@timestamp": {
                                      "gte": "now-30d"
                                  }
                              }
                          },
                          {
                              "match_phrase": {
                                  "tags": "useraudit"
                              }
                          },
                          {
                              "match_phrase": {
                                  "tags": "outsystems"
                              }
                          },
                          {
                              "wildcard": {
                                  "useraudit.message": "role * granted for * by *"
                              }
                          }
                      ]
                    }
                  }
                }
              }
            }
          }
        },
        {
          "revoking": {
            "search": {
              "request": {
                "indices": ["filebeat-*"],
                "body": {
                  "size": 1,
                  "query": {
                    "bool": {
                      "must": [
                          {
                              "range": {
                                  "@timestamp": {
                                      "gte": "now-30d"
                                  }
                              }
                          },
                          {
                              "match_phrase": {
                                  "tags": "useraudit"
                              }
                          },
                          {
                              "match_phrase": {
                                  "tags": "outsystems"
                              }
                          },
                          {
                              "wildcard": {
                                  "useraudit.message": "role * revoked for {{ctx._source.useraudit.entity}} by *"
                              }
                          }
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      ]
    }
  },
  "condition": {
    "always": {
    }
  },
  "actions": {
    "mylog": {
      "foreach": "ctx.payload.granting.hits.hits",
      "logging": {
        "level": "info",
        "text": "The payload is: {{ctx.payload._source.useraudit.entity}}"
      }
    }
  }
}

```

Using `ctx.payload.granting.hits.hits.0._source.useraudit.entity` in the revoked query I am able to get the username for 1 entity. However how can I do this when the first query returns multiple hits?

And then the condition should be if both queries have `gt: 0` for hits.total

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 8, 2020, 10:31am UTC](https://discuss.elastic.co/t/chain-input-watcher-multi-result/213712/2 "2020-01-08T10:31:01Z")

</div>

You can transform input data in a chained input using a [script transform](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/input-chain.html#_transforming_chained_input_data), that may help you here.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2020, 10:31am UTC](https://discuss.elastic.co/t/chain-input-watcher-multi-result/213712/3 "2020-02-05T10:31:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.