# Ctx.payload.hits.total.value in condition not working **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [August 16, 2019, 11:59pm UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578 "2019-08-16T23:59:39Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![maria1](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@maria1](https://discuss.elastic.co/u/maria1)\ **Post date:** [August 16, 2019, 11:59pm UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578/1 "2019-08-16T23:59:40Z")
hello, I'm trying to configure a watch that get eventologs from winlogbeat, in my condition I compare "ctx.payload.hits.total.value" in order to make actions when is greater than 10, but my condition is always false, I have seen next output in watch history "condition" : { "type" : "compare", "status" : "success" "met" : false, "compare" : { "resolved\_values": { "ctx.payload.hits.total.value" : null } } } seems I don't get this value from payload please could someone help me with this issue? I've not idea where could be the problem... thank you in advance ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 19, 2019, 6:46am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578/2 "2019-08-19T06:46:40Z")
can you paste the complete output of the [Execute Watch API](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/watcher-api-execute-watch.html)? Thanks! ---
**Author:** ![maria1](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@maria1](https://discuss.elastic.co/u/maria1)\ **Post date:** [August 19, 2019, 11:52am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578/3 "2019-08-19T11:52:30Z")
Hello, Alexander, below you can find execute output, thank you very much for your help!! { "\_id" : "eventid\_9149a5e7-1009-4227-b312-e8acaca1c193-2019-08-19T11:40:23.8364Z", "watch\_record" : { "watch\_id" : "eventid", "node" : "ZynV4iTUSi2zUDwY6DGEBg", "state" : "execution\_not\_needed", "status" : { "state" : { "active" : true, "timestamp" : "2019-08-19T10:44:07.875Z" }, "last\_checked" : "2019-08-19T11:40:23.836Z", "actions" : { "identificador\_accion" : { "ack" : { "timestamp" : "2019-08-19T10:44:07.875Z", "state" : "awaits\_successful\_execution" } } }, "execution\_state" : "execution\_not\_needed", "version" : 57 }, "trigger\_event" : { "type" : "manual", "triggered\_time" : "2019-08-19T11:40:23.836Z", "manual" : { "schedule" : { "scheduled\_time" : "2019-08-19T11:40:23.836Z" } } }, "input" : { "search" : { "request" : { "search\_type" : "query\_then\_fetch", "indices" : [ "winlogbeat\*" ], "rest\_total\_hits\_as\_int" : true, "body" : { "query" : { "bool" : { "must" : { "match" : { "EventID" : 4625 } } } } } } } }, "condition" : { "compare" : { "ctx.payload.hits.total.value" : { "gte" : 10 } } }, "result" : { "execution\_time" : "2019-08-19T11:40:23.836Z", "execution\_duration" : 0, "input" : { "type" : "search", "status" : "success", "payload" : { "\_shards" : { "total" : 1, "failed" : 0, "successful" : 1, "skipped" : 0 }, "hits" : { "hits" : , "total" : 0, "max\_score" : null }, "took" : 0, "timed\_out" : false }, "search" : { "request" : { "search\_type" : "query\_then\_fetch", "indices" : [ "winlogbeat\*" ], "rest\_total\_hits\_as\_int" : true, "body" : { "query" : { "bool" : { "must" : { "match" : { "EventID" : 4625 } } } } } } } }, "condition" : { "type" : "compare", "status" : "success", "met" : false, "compare" : { "resolved\_values" : { "ctx.payload.hits.total.value" : null } } }, "actions" : }, "messages" : ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 19, 2019, 12:32pm UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578/4 "2019-08-19T12:32:31Z")
check the `result` section of your JSON.. you will see that your search did not return any hits, so not triggering the condition sounds good to me. Also make sure the path your field is the right one, as by default in watcher 7 the `rest_total_hits_as_int` is set to `true` in order to retain BWC. ---
**Author:** ![maria1](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@maria1](https://discuss.elastic.co/u/maria1)\ **Post date:** [August 21, 2019, 11:46am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578/5 "2019-08-21T11:46:10Z")
Hello Alexander, thank you for your answer. I think, then the problem should be the path.. because when I put as condition always my watch work fine. But I don't find where is wrong... as you can see in picture I need to use as condition hits value that is 58, and the path I have configured is ctx.payload.hits.total.value, could you confirm if this is correct? thank you again for your help. ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8ee82ab62c6b5f846c0503c8ead83674411cfc04.png) ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 21, 2019, 1:03pm UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578/6 "2019-08-21T13:03:33Z")
That's why I mentioned that parameter above, as it changes the data structure of the search response. Explicitely it in the `search` input in watcher as well and then things should work. ---
**Author:** ![maria1](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@maria1](https://discuss.elastic.co/u/maria1)\ **Post date:** [August 22, 2019, 11:18am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578/7 "2019-08-22T11:18:08Z")
Thank you very much Alexander!!!!!! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 19, 2019, 11:18am UTC](https://discuss.elastic.co/t/ctx-payload-hits-total-value-in-condition-not-working/195578/8 "2019-09-19T11:18:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.