# Filtering first input result as my second input in Watcher

**URL:** <https://discuss.elastic.co/t/filtering-first-input-result-as-my-second-input-in-watcher/362799>\
**Category:** Elasticsearch\
**Created:** [July 9, 2024, 2:03pm UTC](https://discuss.elastic.co/t/filtering-first-input-result-as-my-second-input-in-watcher/362799 "2024-07-09T14:03:03Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Seemant\_Bind](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/seemant_bind/32/107045_2.png) [@Seemant\_Bind](https://discuss.elastic.co/u/Seemant_Bind)\
**Post date:** [July 9, 2024, 2:03pm UTC](https://discuss.elastic.co/t/filtering-first-input-result-as-my-second-input-in-watcher/362799/1 "2024-07-09T14:03:03Z")

</div>

Hi all,

I am using 2 inputs in watcher. In the first input I have aggreagation level detail of error\_codes, I want to use those error\_codes as filter in my second input. I have tried below but this is not working. Kindly assist in this.  
Below is my watcher script-

```auto
{
  "trigger": {
    "schedule": {
      "hourly": {
        "minute": [
          0,
          30
        ]
      }
    }
  },
  "input": {
    "chain": {
      "inputs": [
		{
          "me": {
            "search": {
              "request": {
                "search_type": "query_then_fetch",
                "indices": [
                  "me"
                ],
                "rest_total_hits_as_int": true,
                "body": {
                  "size": 0,
                    "query": {
						"bool": {
						  "must": [
							{
							  "match_all": {}
							}
						  ],
						  "filter": [
							{
							  "range": {
								"time": {
								  "gte": "{{ctx.trigger.scheduled_time}}||-7d",
								  "lte": "{{ctx.trigger.scheduled_time}}",
								  "format": "strict_date_optional_time||epoch_millis"
								}
							  }
							}
						  ],
						  "should": [],
						  "must_not": []
						}
					  },
					  "aggs": {
						"error_codes": {
						  "terms": {
							"field": "_id",
							"order": {
							  "_count": "desc"
							},
							"size": 5
						  }
						}
					  }
                }
              }
            }
          }
        },
        {
          "error_list": {
            "transform": {
              "script": {
        "source": """
          def keys = [];
          for (bucket in ctx.payload.me.aggregations.error_codes.buckets) {
            keys.add(bucket.key);
          }
          return keys;
        """
      }
            }
          }
        }		
        {
          "low": {
            "search": {
              "request": {
                "search_type": "query_then_fetch",
                "indices": [
                  "mer"
                ],
                "rest_total_hits_as_int": true,
                "body": {
                  "size": 0,
                    "query": {
						"bool": {
						  "must": [
							{
							  "match_all": {}
							}
						  ],
						  "filter": [
							{
							  "range": {
								"time": {
								  "gte": "{{ctx.trigger.scheduled_time}}||-24h",
								  "lte": "{{ctx.trigger.scheduled_time}}",
								  "format": "strict_date_optional_time||epoch_millis"
								}
							  }
							},
							{
							  "terms": {
							     "error_codes": [
							        "{{ctx.payload.error_list._value}}"
							          ]
							}
							}
						  ],
						  "should": [],
						  "must_not": []
						}
					  },
					  "aggs": {
						"error_codes": {
						  "terms": {
							"field": "error_codes",
							"order": {
							  "_count": "desc"
							},
							"size": 5
						  }
						}
					  }
                }
              }
            }
          }
        }
      ]
    }
  }
}

```

I getting the below result from the error\_list input

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34447cb384563d05f7fa89d2b377ec6a9a98c007.png)

But when I am using that list in the terms to filter

```auto
{
	 "terms": {
	 "error_code_id": [
		"{{ctx.payload.error_list._value}}"
			  ]
		}
	}

```

I am getting filter like this-  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/0/90a9e3f66171bd48cfb6e29cd797c3a99dc0f5c3.png)

Kindly guide what needs to be changed