# Conditions on top\_hits results
**URL:** https://discuss.elastic.co/t/conditions-on-top-hits-results/59065
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [August 26, 2016, 6:12pm UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065 "2016-08-26T18:12:20Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@jeffedwards](https://discuss.elastic.co/u/jeffedwards)
#### Post date: [August 26, 2016, 6:12pm UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/1 "2016-08-26T18:12:21Z")
Hello! I've got a series of devices logging status information. I've got an aggregation which breaks down the logs by their device name, and a top\_hits aggregation to get the most recent log entries for each of these devices.
I'm trying to write the condition so it can look inside these hits and see if the time in each log entry is too long ago. Using array\_compare now.
Gist of the Watch I'm PUTting in:
[https://gist.github.com/jeffeDivert/7b213ae9683dc2b18c5686a50c99790c](https://gist.github.com/jeffeDivert/7b213ae9683dc2b18c5686a50c99790c)
I've also tried using array\_compare to just look at each bucket's doc\_count but it doesn't seem to be working as expected, despite the code coming from the reference guide example:
```
"condition" : {
"array_compare": {
"ctx.payload.aggregations.lastheartbeat.buckets" : {
"path": "doc_count",
"lte": {
"value": 25000,
"quantifier": "some"
}
}
}
}
```
Seems to pull up an empty array:
```
"array_compare": {
"resolved_values": {
"ctx.payload.aggregations.lastheartbeat.buckets": []
}
}
```
I feel like I'm overlooking something simple. Setting the Condition to Always or doing a non-array compare on something above the buckets works as expected.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 27, 2016, 9:39am UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/2 "2016-08-27T09:39:52Z")
hey,
can you show a response from the search as an example, so we can dig into this?
--Alex
---
### Author:  [@jeffedwards](https://discuss.elastic.co/u/jeffedwards)
#### Post date: [August 28, 2016, 10:57pm UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/3 "2016-08-28T22:57:38Z")
Surely. Thanks!
>
---
### Author:  [@jeffedwards](https://discuss.elastic.co/u/jeffedwards)
#### Post date: [August 31, 2016, 2:00pm UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/4 "2016-08-31T14:00:16Z")
I'd hope it was a simple mistake in the Watch on my part, but I'm not sure.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [September 5, 2016, 4:23pm UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/5 "2016-09-05T16:23:28Z")
Hey,
sorry for the late response, just got back from being offline.
Can you run the [Execute Watch API](https://www.elastic.co/guide/en/watcher/2.4/api-rest.html#api-rest-execute-watch) and post that output? Your watch condition looks ok, albeit the example output you pasted has no hits above the specified threshold, so I just want to check that output.
Also, I dont think that using datemath in the value is supported on top of my head - which you had in the gist that you pasted.
--Alex
---
### Author:  [@jeffedwards](https://discuss.elastic.co/u/jeffedwards)
#### Post date: [September 5, 2016, 7:34pm UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/6 "2016-09-05T19:34:03Z")
Sorry: I discovered those results were only from a specific day's logs, but that wouldn't ultimately effect the watch.
The execution output on doc count:
>
Execution output lists comparison date value under "resolved\_values":
>
It's figuring the datetime from the condition, but do you mean it's trying to compare int milliseconds to datetime?
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [September 6, 2016, 7:31am UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/7 "2016-09-06T07:31:35Z")
Hey,
there are no search results being returned in both of your gists. Neither hits nor aggs, because not a single document matched.
--Alex
---
### Author:  [@jeffedwards](https://discuss.elastic.co/u/jeffedwards)
#### Post date: [September 6, 2016, 2:50pm UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/8 "2016-09-06T14:50:03Z")
Aha! My indices didn't include a wildcard character. Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:43pm UTC](https://discuss.elastic.co/t/conditions-on-top-hits-results/59065/9 "2017-07-06T13:43:03Z")