# Create a watch with multiple actions each with a different query

**URL:** <https://discuss.elastic.co/t/create-a-watch-with-multiple-actions-each-with-a-different-query/215067>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 15, 2020, 3:05am UTC](https://discuss.elastic.co/t/create-a-watch-with-multiple-actions-each-with-a-different-query/215067 "2020-01-15T03:05:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karrie\_Koo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karrie_koo/32/52576_2.png) [@Karrie\_Koo](https://discuss.elastic.co/u/Karrie_Koo)\
**Post date:** [January 15, 2020, 3:05am UTC](https://discuss.elastic.co/t/create-a-watch-with-multiple-actions-each-with-a-different-query/215067/1 "2020-01-15T03:05:59Z")

</div>

"input": {  
"chain": {  
"inputs": [  
{  
"first": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"indices\*"  
],  
"types": ,  
"body": {  
"size": 10,  
"query": {  
"bool": {  
"must": [  
{  
"simple\_query\_string": {  
"query": "(123)"  
"fields": [  
"Message",  
]  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-15m/m",  
"lte": "now"  
}  
}  
}  
]  
}  
},  
"sort": [  
{  
"@timestamp": {  
"order": "desc"  
}  
}  
]  
}  
}  
}  
}  
},  
{  
"second": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"indices\*"  
],  
"types": ,  
"body": {  
"size": 100,  
"query": {  
"bool": {  
"must": [  
{  
"exists": {  
"field": "abcMsg"  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-15m/m",  
"lte": "now"  
}  
}  
}  
]  
}  
},  
"sort": [  
{  
"@timestamp": {  
"order": "desc"  
}  
}  
]  
}  
}  
}  
}  
}  
]  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},

"actions": {  
"email\_alert": {  
"email": {  
"profile": "standard",  
"to": [  
"'Jennifer [123@gmail.com](mailto:123@gmail.com)'"  
],  
"subject": "{{ctx.payload.hits.hits.0.\_source.hostname}} {{ctx.payload.hits.hits.0.\_source.wlstimestamp}} {{ctx.payload.hits.hits.0.\_source.wlsdomain}} {{ctx.payload.hits.hits.0.\_source.wlsname}} {{ctx.payload.hits.hits.0.\_source.msgId}}",  
"body": {  
"html": "djsghjsakgfdsagksahg"  
}  
}  
},

```
"log_error": {
  "transform": {
    "script": {
      "source": "\t\t\t def docs = [];\n\t\t\t for (hit in ctx.payload.hits.hits) {\n\t\t\t def update = hit['_source'];\n\t\t\t // Pattern to parse the date/timestamp input.\n\t\t\t DateTimeFormatter input = DateTimeFormatter.ofPattern(\"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'\");\n\t\t\t ZonedDateTime date = ZonedDateTime.parse(hit._source['@timestamp'], input.withZone(ZoneId.of(\"UTC\"))).plusHours(8);\n\t\t\t // Pattern to format the parsed date.\n\t\t\t DateTimeFormatter output = DateTimeFormatter.ofPattern(\"yyyy-MM-dd HH:mm:ss\");\n\t\t\t update['logDate'] = date.format(output);\n\t\t\t docs.add(update);\n\t\t}\n return ['exceptions_details': docs];",
      "lang": "painless"
    }
  },
  "logging": {
    "category": "watcher.logging.None",
    "level": "info",
    "text": "Found {{ctx.payload.exceptions_details.size}} exceptions in the server logs\n{{#ctx.payload.exceptions_details}}[{{abc}}] {{def}} {{ghi}} \n{{/ctx.payload.exceptions_details}}"
  }
}

```

}  
}

I want to apply first query to email action and second query to logging action, how could i do

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 15, 2020, 10:22am UTC](https://discuss.elastic.co/t/create-a-watch-with-multiple-actions-each-with-a-different-query/215067/2 "2020-01-15T10:22:14Z")

</div>

hey.

please take your time to properly format snippets. This forum supports markdown, please use that to make your JSON more readable and indented. Thanks!

if you use the chain input, your payload changes based on the name of the chain inputs, so it's `ctx.payload.first` and `ctx.payload.second` and everything below that.

However, why don't you just use two different watches in that case?

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 12, 2020, 10:22am UTC](https://discuss.elastic.co/t/create-a-watch-with-multiple-actions-each-with-a-different-query/215067/3 "2020-02-12T10:22:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.