# Count the chattiest server

**URL:** https://discuss.elastic.co/t/count-the-chattiest-server/275412
**Category:** Elasticsearch
**Created:** [June 9, 2021, 9:15am UTC](https://discuss.elastic.co/t/count-the-chattiest-server/275412 "2021-06-09T09:15:22Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![A\_Mightiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_mightiev/32/62186_2.png) [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)
#### Post date: [June 9, 2021, 9:15am UTC](https://discuss.elastic.co/t/count-the-chattiest-server/275412/1 "2021-06-09T09:15:22Z")

</div>

Hi I am getting logs from different servers and I would like to get a watcher where it will count the number of errors reported and trigger a response after certain threshold.  
I have it worked but it counts all errors on all servers, how can I specifically get the highest number of any server?  
Here's my watcher:

```auto
{
  "trigger": {
    "schedule": {
      "interval": "24h"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "logs*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-1d",
                      "lte": "{{ctx.trigger.scheduled_time}}",
                      "format": "strict_date_optional_time||epoch_millis"
                    }
                  }
                },
                {
                  "term": {
                    "log.level": "Error"
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "if (ctx.payload.hits.total > params.threshold) { return true; } return false;",
      "lang": "painless",
      "params": {
        "threshold": 1000
      }
    }
  },
  "actions": {
    "slack_1": {
      "slack": {
        "message": {
          "text": "More than 1000 errors reported"
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "HashMap result = new HashMap(); result.result = ctx.payload.hits.total; return result;",
      "lang": "painless",
      "params": {
        "threshold": 100
      }
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![mayya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mayya/32/83147_2.png) [@mayya](https://discuss.elastic.co/u/mayya)
#### Post date: [June 10, 2021, 8:59pm UTC](https://discuss.elastic.co/t/count-the-chattiest-server/275412/2 "2021-06-10T20:59:59Z")

</div>

The way I can think this could be accomplished is by adding terms aggregation on "server" field to your query, and then you would need to access the 1st bucket (I think should be `ctx.payload.aggregations.<my_agg>.buckets[0].doc_count`) in this aggregation in the watch condition.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 8, 2021, 9:00pm UTC](https://discuss.elastic.co/t/count-the-chattiest-server/275412/3 "2021-07-08T21:00:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.