# Conditional string message of a Watch

**URL:** <https://discuss.elastic.co/t/conditional-string-message-of-a-watch/287608>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting, painless\
**Created:** [October 25, 2021, 5:03pm UTC](https://discuss.elastic.co/t/conditional-string-message-of-a-watch/287608 "2021-10-25T17:03:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rowish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rowish/32/98815_2.png) [@rowish](https://discuss.elastic.co/u/rowish)\
**Post date:** [October 25, 2021, 5:03pm UTC](https://discuss.elastic.co/t/conditional-string-message-of-a-watch/287608/1 "2021-10-25T17:03:17Z")

</div>

I am wondering if there is possible to embed in a watch such a mechanism that will use a sort of variable to determine the string in the email message of the action based on the chain input data.

Specifically, instead of two separate watches doing a complementary search in their input, I would like to combine them in a single watch and generate the email message according to which bucket has met the merged execution condition.

The code bellow includes a placeholder for the mentioned message.

```auto
{
  "trigger": {
    "schedule": {
      "cron": "0 0 * * * ?"
    }
  },
  "input": {
    "chain": {
      "inputs": [
        {
          "production": {
            "search": {
              "request": {
                "search_type": "query_then_fetch",
                "indices": [
                  "messages_production"
                ],
                "rest_total_hits_as_int": true,
                "body": {
                  "size": 0,
                  "query": {
                    "bool": {
                      "filter": {
                        "range": {
                          "@timestamp": {
                            "gte": "now-1h",
                            "lte": "now"
                          }
                        }
                      },
                      "must": [
                        {
                          "query_string": {
                            "query": "status: success",
                            "analyze_wildcard": true
                          }
                        }
                      ]
                    }
                  }
                }
              }
            }
          }
        },
        {
          "conformance": {
            "search": {
              "request": {
                "search_type": "query_then_fetch",
                "indices": [
                  "messages_conformance"
                ],
                "rest_total_hits_as_int": true,
                "body": {
                  "size": 0,
                  "query": {
                    "bool": {
                      "filter": {
                        "range": {
                          "@timestamp": {
                            "gte": "now-1h",
                            "lte": "now"
                          }
                        }
                      },
                      "must": [
                        {
                          "query_string": {
                            "query": "status: success",
                            "analyze_wildcard": true
                          }
                        }
                      ]
                    }
                  }
                }
              }
            }
          }
        }
      ]
    }
  },
  "condition": {
    "script": {
      "source": "return (ctx.payload.production.hits.total == 0) || (ctx.payload.conformance.hits.total == 0)",
      "lang": "painless"
    }
  },
  "actions": {
    "send_email": {
      "throttle_period_in_millis": 3600,
      "email": {
        "profile": "standard",
        "to": [
          "monitoring@test.com"
        ],
        "subject": "{{ctx.metadata.name}}",
        "body": {
          "text": """Application: Oracle Management
Summary: Missing events in last hour
Severity: Medium
Environment: [placeholder]"""
        }
      }
    }
  }
}

```

Basically, if the production bucket lacks data, then the "Environment:" field will read "production", if the conformance bucket lacks data, the field will read "conformance", and if both do lack data, then the field will read "production and conformance".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2021, 5:04pm UTC](https://discuss.elastic.co/t/conditional-string-message-of-a-watch/287608/2 "2021-11-22T17:04:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.