# Ctx.payload.hits.total returns zero

**URL:** <https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 5, 2018, 11:06am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275 "2018-01-05T11:06:16Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ravirjn](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@ravirjn](https://discuss.elastic.co/u/ravirjn)\
**Post date:** [January 5, 2018, 11:06am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275/1 "2018-01-05T11:06:17Z")

</div>

Hi,

I created a watcher in Kibana for sending an email alert on every failed login for root, but it's not working properly. Condition part returns zero hits even after giving wrong password for the root login. Below is the watcher:

{  
"trigger": {  
"schedule": {  
"interval": "10s"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"logs"  
],  
"types": [],  
"body": {  
"query": {  
"match": {  
"message": "Failed password"  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},  
"actions": {  
"send\_email": {  
"email": {  
"profile": "standard",  
"to": [  
"[email@domain.com](mailto:email@domain.com)"  
],  
"subject": "Watcher Notification",  
"body": {  
"text": "root login failed alert"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 8, 2018, 8:09am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275/2 "2018-01-08T08:09:20Z")

</div>

can you share the output of the [Execute Watch API([https://www.elastic.co/guide/en/elasticsearch/reference/6.1/watcher-api-execute-watch.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.1/watcher-api-execute-watch.html)) or the latest watch history entry?

Also, please take the time to properly format your message. This forum supports markdown which makes it super simple to include nicely formatted code snippets.

--Alex

---

<div class="post-metadata">

**Author:** ![ravirjn](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@ravirjn](https://discuss.elastic.co/u/ravirjn)\
**Post date:** [January 8, 2018, 10:17am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275/3 "2018-01-08T10:17:27Z")

</div>

Here is the output of the watcher.

```auto
{
  "watch_id": "Test_ID",
  "state": "execution_not_needed",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2018-01-08T10:05:01.553Z"
    },
    "last_checked": "2018-01-08T10:07:01.868Z",
    "actions": {
      "send_email": {
        "ack": {
          "timestamp": "2018-01-08T10:04:55.058Z",
          "state": "awaits_successful_execution"
        }
      }
    }
  },
  "trigger_event": {
    "type": "schedule",
    "triggered_time": "2018-01-08T10:07:01.868Z",
    "schedule": {
      "scheduled_time": "2018-01-08T10:07:01.594Z"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "logs"
        ],
        "types": [],
        "body": {
          "query": {
            "match": {
              "message": "Failed password"
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "result": {
    "execution_time": "2018-01-08T10:07:01.868Z",
    "execution_duration": 0,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 0,
          "failed": 0,
          "successful": 0,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 0,
          "max_score": 0
        },
        "took": 0,
        "timed_out": false
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "logs"
          ],
          "types": [],
          "body": {
            "query": {
              "match": {
                "message": "Failed password"
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": false,
      "compare": {
        "resolved_values": {
          "ctx.payload.hits.total": 0
        }
      }
    },
    "actions": []
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 8, 2018, 11:24am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275/4 "2018-01-08T11:24:20Z")

</div>

If you read the output, that includes the response of the search in the `result.input.payload` field, you will see, that your query did not return any documents. Which in turn means the watch acts as expected.

You may need to refine your query.

--Alex

---

<div class="post-metadata">

**Author:** ![ravirjn](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@ravirjn](https://discuss.elastic.co/u/ravirjn)\
**Post date:** [January 9, 2018, 4:40am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275/5 "2018-01-09T04:40:10Z")

</div>

I think the problem is with timestamp. The log generation time in kibana and the triggered\_time in watcher output are different (different time zones). I went through many discussions in the forum about the same issue, but, no luck.

Please help.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 9, 2018, 8:30am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275/6 "2018-01-09T08:30:47Z")

</div>

Your query from the execute watch output does not include any timestamp, so why should this be an issue?

This query did not return anything. Maybe you need to specify `logs-*` or something?

```auto
GET logs/_search
{
  "query": {
    "match": {
      "message": "Failed password"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![ravirjn](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@ravirjn](https://discuss.elastic.co/u/ravirjn)\
**Post date:** [January 9, 2018, 12:08pm UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275/7 "2018-01-09T12:08:37Z")

</div>

Thanks for the support.

There was a small mistake, I replaced `logs` with `filebeat-*`. Now I am getting alerts.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 6, 2018, 12:08pm UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-returns-zero/114275/8 "2018-02-06T12:08:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.