# Examples for building percolator with aggregations **URL:** \ **Category:** Elasticsearch\ **Created:** [July 22, 2015, 6:39pm UTC](https://discuss.elastic.co/t/examples-for-building-percolator-with-aggregations/26105 "2015-07-22T18:39:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![frank\_van](https://avatars.discourse-cdn.com/v4/letter/f/d26b3c/32.png) [@frank\_van](https://discuss.elastic.co/u/frank_van)\ **Post date:** [July 22, 2015, 6:39pm UTC](https://discuss.elastic.co/t/examples-for-building-percolator-with-aggregations/26105/1 "2015-07-22T18:39:20Z")
Hi, I have a stream keep feeding elasticsearch for the following events: `POST /test_index/test_type/_bulk {"index":{"_id":"1"}} {"timestamp": "2015/07/22 08:00:00", "host": "www.google.com", "hits": 100} {"index":{"_id":"2"}} {"timestamp": "2015/07/22 08:01:00", "host": "www.google.com", "hits": 20} {"index":{"_id":"3"}} {"timestamp": "2015/07/22 08:02:00", "host": "www.facebook.com", "hits": 200} {"index":{"_id":"4"}} {"timestamp": "2015/07/22 08:03:00", "host": "www.yahoo.com", "hits": 80}` i.e., each document contains timestamp, host and hits. I'm trying to figure out how to use percolator to build an alerting so that it's triggered when the following conditions are met: 1. During the past 5 minutes, any host's average hits exceeds 100; 2. During the past 10 minutes, the difference between the max hits and the min hits for host [www.google.com](http://www.google.com) exceeds 50. This specific use case is hypothetical, but in general what I'm looking for are: 1. How can I build a percolator with aggregations? The percolator documents indicate it's possible but I didn't find any examples. 2. How can I pass multiple documents to a percolator? All existing examples just pass a single document to a percolator, but the alerting conditions for my case requires aggregations across multiple documents. 3. As a variation of #2, is it possible to pass multiple existing indexed documents to a percolator? It would be appreciated if anyone can shed some light on this. Thanks, Frank ---
**Author:** ![frank\_van](https://avatars.discourse-cdn.com/v4/letter/f/d26b3c/32.png) [@frank\_van](https://discuss.elastic.co/u/frank_van)\ **Post date:** [July 25, 2015, 5:25pm UTC](https://discuss.elastic.co/t/examples-for-building-percolator-with-aggregations/26105/2 "2015-07-25T17:25:18Z")
Anyone has any insight please? To me it is a fairly common use case, and I don't believe I'm the first person running into this. ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [July 26, 2015, 8:08am UTC](https://discuss.elastic.co/t/examples-for-building-percolator-with-aggregations/26105/3 "2015-07-26T08:08:08Z")
Imagine a real estate agent with an index full of houses for sale ("supply") and a bunch of buyer details, registered as percolator queries looking for different sorts of houses ("demand") and with metadata describing the buyer eg date registered, Is-part-of-chain etc. this metadata can be provided as part of the json that contains a percolator query. With this setup the estate agent can tell a prospective seller the level of demand for his house before he signs up. Given the house details, a percolate call can use aggregations to summarise the metadata on the buyers. A query on the percolate request could also rank the interested buyers based on their metadata eg how recently they registered interest. This is demand-side aggregation in a supply/demand relationship. What you are after sounds more like the newly launched "Watcher". ---
**Author:** ![Norberto\_Meijome](https://avatars.discourse-cdn.com/v4/letter/n/ed655f/32.png) [@Norberto\_Meijome](https://discuss.elastic.co/u/Norberto_Meijome)\ **Post date:** [August 20, 2015, 11:55pm UTC](https://discuss.elastic.co/t/examples-for-building-percolator-with-aggregations/26105/4 "2015-08-20T23:55:53Z")
Hi Frank, AFAIK, percolators have no context outside of the document you are percolating. You _might_ be able to do something with scripts, but I dont think you can kick another search off a script (at least it doesnt sound like a good idea...) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:54pm UTC](https://discuss.elastic.co/t/examples-for-building-percolator-with-aggregations/26105/5 "2017-07-05T23:54:42Z")