# Chained input query - looping over hits values in query
**URL:** https://discuss.elastic.co/t/chained-input-query-looping-over-hits-values-in-query/212903
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [December 24, 2019, 12:42am UTC](https://discuss.elastic.co/t/chained-input-query-looping-over-hits-values-in-query/212903 "2019-12-24T00:42:00Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Inammathe\_Inna](https://discuss.elastic.co/u/Inammathe_Inna)
#### Post date: [December 24, 2019, 12:42am UTC](https://discuss.elastic.co/t/chained-input-query-looping-over-hits-values-in-query/212903/1 "2019-12-24T00:42:00Z")
Hello,
So I am a little stuck with this one..
Following this example: [https://github.com/elastic/examples/blob/master/Alerting/Sample%20Watches/ml\_examples/bucket\_record\_chain\_watch.json](https://github.com/elastic/examples/blob/master/Alerting/Sample%20Watches/ml_examples/bucket_record_chain_watch.json)
I've managed to successfully create a chained input query that uses **first** result in a terms query like so:
```
"query": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gt": "{{ctx.payload.first.aggregations.record_results.top_record_hits.hits.hits.0.fields.start.0}}",
"lt": "{{ctx.payload.first.aggregations.record_results.top_record_hits.hits.hits.0.fields.end.0}}"
}
}
},
{
"term": {
"request_IPAddress":"{{ctx.payload.first.aggregations.record_results.top_record_hits.hits.hits.0._source.over_field_value}}"
}
}
]
}
}
```
I was wondering.. how might I go about unpacking `ctx.payload.first.aggregations.record_results.top_record_hits.hits.hits` so that I can find all documents with the `_source.over_field_value` rather than just the first result in the array in `hits.0` ?
I've played around with the mustache syntax to try and get it to look like this for example: ` "request_IPAddress": ["49.195.126.239","1.128.107.52"]`
But being json I am not sure that is possible with mustache..
Really appreciate any advice you can give
Thanks!
---
### Author:  [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [December 30, 2019, 3:59pm UTC](https://discuss.elastic.co/t/chained-input-query-looping-over-hits-values-in-query/212903/2 "2019-12-30T15:59:09Z")
You can use a script `transform` to manipulate and re-format the payload using painless scripting. See: [https://www.elastic.co/guide/en/elasticsearch/reference/7.5/transform.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/transform.html)
Within a chained input, one of the chains can simply be a transform. Here's an example:
Here's what the `query_string` resolved to after the transform (that was passed to the third input):
```auto
"query_string" : {
"query" : "(timestamp:1486656900000 AND airline:AAL) OR (timestamp:1486656000000 AND airline:AAL) OR (timestamp:1486638900000 AND airline:ACA)"
}
```
---
### Author:  [@Inammathe\_Inna](https://discuss.elastic.co/u/Inammathe_Inna)
#### Post date: [December 31, 2019, 7:08am UTC](https://discuss.elastic.co/t/chained-input-query-looping-over-hits-values-in-query/212903/3 "2019-12-31T07:08:58Z")
Brilliant! Thanks Rich. Really simple, I'll definitely be using this a lot for other stuff.
Cheers
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 28, 2020, 7:16am UTC](https://discuss.elastic.co/t/chained-input-query-looping-over-hits-values-in-query/212903/4 "2020-01-28T07:16:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.