# Elasticsearch query | DSL Rules trigger count

**URL:** https://discuss.elastic.co/t/elasticsearch-query-dsl-rules-trigger-count/374810
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [February 20, 2025, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-rules-trigger-count/374810 "2025-02-20T11:47:36Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![joaosf](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@joaosf](https://discuss.elastic.co/u/joaosf)
#### Post date: [February 20, 2025, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-rules-trigger-count/374810/1 "2025-02-20T11:47:37Z")

</div>

Hi all,

I created a script query and now I want to trigger an email if the count is more than 0.

```auto
GET /xpto_xpto/_search
{
  "_source": false,
  "track_total_hits": false,
  "size": 0, 
  "query": {
    "bool": {
    }
  },
  
  "aggs": {
    "filter_folder_ids_not_in_dossier": {
      "scripted_metric": {
        "init_script": """
        // Inicializa listas para folderIds e Dossiers
        state.folderIds = [];
        state.dossiers = [];
        """,
        "map_script": """
        // Adiciona valores de folderId
        if (doc.containsKey('folderId.keyword') && doc['folderId.keyword'].size() > 0) {
          def folderIdValue = doc['folderId.keyword'].value;
          if (!state.folderIds.contains(folderIdValue)) {
            state.folderIds.add(folderIdValue);
          }
        }
        // Adiciona valores de Dossier
        if (doc.containsKey('dossier') && doc['dossier'].size() > 0) {
          def dossierValue = doc['dossier'].value;
          if (!state.dossiers.contains(dossierValue)) {
            state.dossiers.add(dossierValue);
          }
        }
        """,
        "combine_script": """
        // Combina todos os valores em um único estado
        return state;
        """,
        "reduce_script": """
        // Compara os valores de folderIds com os de Dossiers
        def folderIdsNotInDossiers = [];
        for (folderId in states[0].folderIds) {
          if (!states[0].dossiers.contains(folderId)) {
            folderIdsNotInDossiers.add(folderId);
          }
        }
        // Retorna apenas o count
        //return folderIdsNotInDossiers.size();
        return ['folderIds': folderIdsNotInDossiers, 'count': folderIdsNotInDossiers.size()];
        """
      }
    }
  }
}

```

The result it's perfect:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/6/16484aa73ef36dcd3d2214e9b83d0c6bc70cd6f6.png)

But when I create the Rule Elasticsearch query | DSL and run the "Test query" the count it's not 3 but 12, all the events:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/9/99d761c54022c49b30df7c3cdcfa2a2a67d78198.png)

How can I force the rule to check my aggregation count?