# Elastic Watcher

**URL:** <https://discuss.elastic.co/t/elastic-watcher/357520>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [April 16, 2024, 1:42pm UTC](https://discuss.elastic.co/t/elastic-watcher/357520 "2024-04-16T13:42:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashish25](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@ashish25](https://discuss.elastic.co/u/ashish25)\
**Post date:** [April 16, 2024, 1:42pm UTC](https://discuss.elastic.co/t/elastic-watcher/357520/1 "2024-04-16T13:42:09Z")

</div>

Hi Team,

I created below watcher -

PUT \_watcher/watch/transaction\_status\_watch  
{  
"trigger": {  
"schedule": {  
"interval": "10s"  
}  
},  
"input": {  
"search": {  
"request": {  
"indices": ["test-transaction"],  
"body": {  
"query": {  
"match": {  
"status": "Initiate"  
}  
}  
}  
}  
}  
},  
"condition": {  
"script": {  
"source": "if (ctx.payload.hits.hits.size() \> 0) { return true; } else { return false; }",  
"lang": "painless"  
}  
},  
"actions": {  
"index\_payload": {  
"transform" : {  
"script" : {  
"source": "ctx.payload.hits.hits[0].\_source.status = 'new\_value'; return ctx.payload.hits.hits[0].\_source",  
"lang": "painless"  
}  
},  
"index": {  
"index": "test-transaction",  
**"doc\_id": "{{ctx.payload.hits.hits.0.\_id}}"**  
}  
},  
"log" : {  
"logging" : {  
"text" : "Found {{ctx.payload.hits.total}} -- {{ctx.payload.hits.hits.0.\_source.correlationId}} -- {{ctx.payload.hits.hits.0.\_id}} errors in the logs"  
}  
}  
}  
}

But {{ctx.payload.hits.hits.0.\_id}} is not able to find the value instead of that it is creating new document like below-

{  
"\_index" : "test-transaction",  
"\_type" : "\_doc",  
**"\_id" : "{{ctx.payload.hits.hits.0.\_id}}",**  
"\_score" : 1.0,  
"\_source" : {  
"payload" : "data",  
"correlationId" : "123",  
"status" : "new\_value"  
}

Please let me know if I am missing something.

---

<div class="post-metadata">

**Author:** ![ashish25](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@ashish25](https://discuss.elastic.co/u/ashish25)\
**Post date:** [April 17, 2024, 5:53am UTC](https://discuss.elastic.co/t/elastic-watcher/357520/2 "2024-04-17T05:53:20Z")

</div>

Anyone face this issue, really appreciate for your help here.