# Email alert could not getting the value of a map defined in conditions

**URL:** <https://discuss.elastic.co/t/email-alert-could-not-getting-the-value-of-a-map-defined-in-conditions/114682>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 9, 2018, 10:33am UTC](https://discuss.elastic.co/t/email-alert-could-not-getting-the-value-of-a-map-defined-in-conditions/114682 "2018-01-09T10:33:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunnywalden](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sunnywalden](https://discuss.elastic.co/u/sunnywalden)\
**Post date:** [January 9, 2018, 10:33am UTC](https://discuss.elastic.co/t/email-alert-could-not-getting-the-value-of-a-map-defined-in-conditions/114682/1 "2018-01-09T10:33:33Z")

</div>

**here is my search response:**

```
{
  "took": 638,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 2705428,
    "max_score": 0,
    "hits": []
  },
  "aggregations": {
    "group_by_source": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "jiwei",
          "doc_count": 2599928,
          "group_by_logtype": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "clickNumber",
                "doc_count": 2599894
              },
              {
                "key": "advAckAllNumber",
                "doc_count": 34
              }
            ]
          }
        },
        {
          "key": "zhitou",
          "doc_count": 105473,
          "group_by_logtype": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "clickNumber",
                "doc_count": 105471
              },
              {
                "key": "advAckAllNumber",
                "doc_count": 2
              }
            ]
          }
        },
        {
          "key": "kejin",
          "doc_count": 15,
          "group_by_logtype": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "clickNumber",
                "doc_count": 13
              },
              {
                "key": "advAckAllNumber",
                "doc_count": 2
              }
            ]
          }
        },
        {
          "key": "mex",
          "doc_count": 11,
          "group_by_logtype": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "clickNumber",
                "doc_count": 10
              },
              {
                "key": "advAckAllNumber",
                "doc_count": 1
              }
            ]
          }
        },
        {
          "key": "applovin",
          "doc_count": 1,
          "group_by_logtype": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "key": "clickNumber",
                "doc_count": 1
              }
            ]
          }
        }
      ]
    }
  }
}

```

**And here is my watch rules, how could I get the value of rates that defined in conditions in the email?**

```
{
  "trigger": {
    "schedule": {
      "cron": "0 0 11 * * ?"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "logstash-*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": {
                "range": {
                  "@timestamp": {
                    "gte": "now-8d/d",
                    "lte": "now-8d/d",
                    "time_zone": "+00:00"
                  }
                }
              },
              "filter": {
                "query_string": {
                  "query": "(appid:1179908959)AND(log_type:(clickNumber|advAckAllNumber))"
                }
              }
            }
          },
          "aggs": {
            "group_by_source": {
              "terms": {
                "field": "source.keyword",
                "size": 50
              },
              "aggs": {
                "group_by_logtype": {
                  "terms": {
                    "field": "log_type.keyword"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "def hg = 0.0005;def lw = 0.0001;def len_th = ctx.payload.aggregations.group_by_source.buckets.size();def rate = 0.0;def rates = new HashMap();def lt = 0;for (def i = 0; i < len_th; i++) { lt = ctx.payload.aggregations.group_by_source.buckets[i].group_by_logtype.buckets.length;if (lt === 1 ) { rate = 0 } else { rate = ctx.payload.aggregations.group_by_source.buckets[i].group_by_logtype.buckets.1.doc_count / ctx.payload.aggregations.group_by_source.buckets[i].group_by_logtype.buckets.0.doc_count } if ( rate < lw || rate > hg ) { rates[ctx.payload.aggregations.group_by_source.buckets[i].key] = rate } } return len_th === 5 ;",
      "lang": "painless"
    }
  },
  "actions": {
    "email_admin": {
      "email": {
        "profile": "standard",
        "from": "bo.zhang@jcmob.net",
        "to": [
          "bo.zhang@jcmob.net"
        ],
        "subject": "J&C source activate rate is out of range",
        "body": {
          "text": " The info locate at: http://10.61.8.15:5601/goto/50f91b750a67fe933dd52e431b250d3f"
        }
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![sunnywalden](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sunnywalden](https://discuss.elastic.co/u/sunnywalden)\
**Post date:** [January 9, 2018, 11:16am UTC](https://discuss.elastic.co/t/email-alert-could-not-getting-the-value-of-a-map-defined-in-conditions/114682/2 "2018-01-09T11:16:07Z")

</div>

Does dynamic variable applys to my issue? Is there any example using dynamic variable in Watcher?

 ![bak](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35d9a123ee8b593541617b2a6dca5a056fa25154.png)

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 10, 2018, 8:25am UTC](https://discuss.elastic.co/t/email-alert-could-not-getting-the-value-of-a-map-defined-in-conditions/114682/3 "2018-01-10T08:25:31Z")

</div>

Having a one line script makes it super unreadable for anyone, even yourself. Kibana has a nice feature that if you use `"""` to start a script with, you can write multi-line scripts - and share them here (at the expense that this is a pure kibana feature).

Now on to your issue: If you want the `rates` variable to be available in your action, you need to use a [script transform](https://www.elastic.co/guide/en/x-pack/6.1/transform.html) to add it to the existing payload, like this

```auto
def payload = ctx.payload;
payload.rates = YOUR_CALCULATION
return payload

```

hope this helps

---

<div class="post-metadata">

**Author:** ![sunnywalden](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sunnywalden](https://discuss.elastic.co/u/sunnywalden)\
**Post date:** [January 11, 2018, 1:58am UTC](https://discuss.elastic.co/t/email-alert-could-not-getting-the-value-of-a-map-defined-in-conditions/114682/4 "2018-01-11T01:58:48Z")

</div>

Thanks for your reply, with your help I can get the value right now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2018, 1:58am UTC](https://discuss.elastic.co/t/email-alert-could-not-getting-the-value-of-a-map-defined-in-conditions/114682/5 "2018-02-08T01:58:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.