# Check some condition for every document in buckets
**URL:** https://discuss.elastic.co/t/check-some-condition-for-every-document-in-buckets/160770
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [December 13, 2018, 4:00pm UTC](https://discuss.elastic.co/t/check-some-condition-for-every-document-in-buckets/160770 "2018-12-13T16:00:55Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@\_Sergey](https://discuss.elastic.co/u/_Sergey)
#### Post date: [December 13, 2018, 4:00pm UTC](https://discuss.elastic.co/t/check-some-condition-for-every-document-in-buckets/160770/1 "2018-12-13T16:00:55Z")
Hello all,
Can you advise/help about:
I use input chain in my Watcher. And I want to compare first, second, third etc.. doc\_count of document from first input with first, second. third etc... doc\_count of document form the second input respectively.
So I have such output:
```
"hits": {
"hits": [],
"total": 911227,
"max_score": 0
},
"took": 1345,
"timed_out": false,
"aggregations": {
"operator": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 855146,
"buckets": [
{
"doc_count": 117,
"key": "Adam"
},
{
"doc_count": 2,
"key": "Tom"
}
]
}
}
},
"second": {
"_shards": {
"total": 1490,
"failed": 0,
"successful": 1490,
"skipped": 1408
},
"hits": {
"hits": [],
"total": 23458525,
"max_score": 0
},
"took": 1748,
"timed_out": false,
"aggregations": {
"operator": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 127850,
"key": "Adam"
},
{
"doc_count": 161879,
"key": "Tom"
.....
```
And I want to compare Adam doc\_count from 1st input vs Adam doc\_count from 2nd input, the same for Tom and if for any of them doc\_count/doc\_count \> 1% notify me.
The problem is that amount of key in buckets (will be changed randomly) so I can't just use smth like (just put every possible document from bucket):
> "condition": {
> "script": {
> "source": " ctx.vars.a = (ctx.payload.first.aggregations.operator.buckets.0.doc\_count / ctx.payload.second.aggregations.operator.buckets.0.doc\_count); ctx.vars.b = (ctx.payload.first.aggregations.operator.buckets.1.doc\_count / ctx.payload.second.aggregations.operator.buckets.1.doc\_count); if ((ctx.vars.a \> 0.01)||(ctx.vars.b \> 0.01) return true; else return false;",
> "lang": "painless" }}
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 7, 2019, 9:51am UTC](https://discuss.elastic.co/t/check-some-condition-for-every-document-in-buckets/160770/2 "2019-01-07T09:51:15Z")
Hey,
this indeed requires some transformation before the condition. I would walk through each of the requests and create a map for each of them, that consists of the key being the name and the doc count being the value. Then it is super easy to run the comparison by just going through the keys of that map.
Hope this helps.
--Alex
---
### Author:  [@\_Sergey](https://discuss.elastic.co/u/_Sergey)
#### Post date: [January 9, 2019, 3:41pm UTC](https://discuss.elastic.co/t/check-some-condition-for-every-document-in-buckets/160770/3 "2019-01-09T15:41:26Z")
Hey Alex, Thanks for pointing direction how to do that.
For now honestly don't understand how to implement cause didn't use previously.
Will try to find good examples of transform and use it.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 10, 2019, 3:17pm UTC](https://discuss.elastic.co/t/check-some-condition-for-every-document-in-buckets/160770/4 "2019-01-10T15:17:19Z")
Hey,
the [examples repo](https://github.com/elastic/examples/tree/master/Alerting) is a good start to check out more conditions and transforms.
--Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 7, 2019, 3:17pm UTC](https://discuss.elastic.co/t/check-some-condition-for-every-document-in-buckets/160770/5 "2019-02-07T15:17:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.