Chained input query - looping over hits values in query


So I am a little stuck with this one..
Following this example:

I've managed to successfully create a chained input query that uses first result in a terms query like so:

"query": {
  "bool": {
    "must": [
        "range": {
          "@timestamp": {
            "gt": "{{ctx.payload.first.aggregations.record_results.top_record_hits.hits.hits.0.fields.start.0}}",
            "lt": "{{ctx.payload.first.aggregations.record_results.top_record_hits.hits.hits.0.fields.end.0}}"
        "term": {

I was wondering.. how might I go about unpacking ctx.payload.first.aggregations.record_results.top_record_hits.hits.hits so that I can find all documents with the _source.over_field_value rather than just the first result in the array in hits.0 ?

I've played around with the mustache syntax to try and get it to look like this for example: "request_IPAddress": ["",""]
But being json I am not sure that is possible with mustache..

Really appreciate any advice you can give


You can use a script transform to manipulate and re-format the payload using painless scripting. See:

Within a chained input, one of the chains can simply be a transform. Here's an example:

Here's what the query_string resolved to after the transform (that was passed to the third input):

                          "query_string" : {
                            "query" : "(timestamp:1486656900000 AND airline:AAL) OR (timestamp:1486656000000 AND airline:AAL) OR (timestamp:1486638900000 AND airline:ACA)"

1 Like

Brilliant! Thanks Rich. Really simple, I'll definitely be using this a lot for other stuff.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.