# Elasticsearch Query Rule Group By

**URL:** https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [April 26, 2022, 6:03pm UTC](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314 "2022-04-26T18:03:51Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)
#### Post date: [April 26, 2022, 6:03pm UTC](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314/1 "2022-04-26T18:03:52Z")

</div>

Hi All,

(Elasticsearch & Kibana 7.17.2)

I'm trying to create an Elasticsearch query rule in Kibana observability which group bys a concept. I have the following rule configured:

Index: `synthetics-*`  
Size: `100`

```auto
{
  "aggs": {
    "0": {
      "terms": {
        "field": "url.domain",
        "order": {
          "_count": "desc"
        },
        "size": 25
      }
    }
  },
  "query": {
    "bool": {
      "filter": [
        {
          "match_phrase": {
            "data_stream.dataset": "tcp"
          }
        },
        {
          "match_phrase": {
            "tags": "_dns_reverse_lookup_failed"
          }
        },
        {
          "match_phrase": {
            "tags": "dnsrpz"
          }
        }
      ]
    }
  }
}

```

Is Above: `5`  
For the Last: `5 Minutes`

The issue I'm running into is that I can't figure out how to actually access the grouped by values in an Action.

I tried:

```auto
Elasticsearch query alert '{{alertName}}' is active:

- Value: {{context.value}}
- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}
- Timestamp: {{context.date}}

{{#context.hits}}
{{_source.url.domain}}
{{/context.hits}}

{{#context.aggregations.0.buckets}}
{{key}}
{{doc_count}}
{{/context.aggregations.0.buckets}}

```

While the `{{#context.hits}}` section is populated, the `{{#context.aggregations.0.buckets}}` section is blank.

Would anyone know how to achieve this?

The `agg` output looks something like:

```auto
"aggregations": {
  "0": {
    "doc_count_error_upper_bound": 0,
    "sum_other_doc_count": 0,
    "buckets": [
      {
        "key": "192.168.1.1",
        "doc_count": 179
      },
      {
        "key": "192.168.1.2",
        "doc_count": 179
      }
    ]
  }
}

```

And this is really what I want to use for the alert, not the actual hits.

Note: I tried using the Log Threshold rule:

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/3/336d8194910a4744aef314c872f8b4420f460dce.png)

But this rule takes far too long to execute (~10 - 20 seconds!), where the Elasticsearch query takes (~100ms - 1 second).

So, I don't think the Log Threshold rule is the correct rule for this use case.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 24, 2022, 6:04pm UTC](https://discuss.elastic.co/t/elasticsearch-query-rule-group-by/303314/2 "2022-05-24T18:04:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.