# Foreach for bucket aggregation in watcher not working
**URL:** https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523
**Category:** Elasticsearch
**Created:** [November 6, 2020, 12:00pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523 "2020-11-06T12:00:40Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@priti](https://discuss.elastic.co/u/priti)
#### Post date: [November 6, 2020, 12:00pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523/1 "2020-11-06T12:00:40Z")
Hi ,
I am trying to logging according to user using **foreach** but it is giving exception
"type" : "exception",
"reason" : "specified foreach object was null: [ctx.payload.aggregations.user.buckets.keys]"
}
* * *
## **Foreach Condition**"foreach" : "ctx.payload.aggregations.user.buckets.keys", "logging":{ "text":" {{#ctx.payload.aggregations.user.buckets}}{{key}} {{/ctx.payload.aggregations.user.buckets}} " } }
**Aggregation Result**
"aggregations" : {
"user" : {
"doc\_count\_error\_upper\_bound" : 0,
"sum\_other\_doc\_count" : 0,
"buckets" : [
{
"doc\_count" : 6,
"instance" : {
"doc\_count\_error\_upper\_bound" : 0,
"sum\_other\_doc\_count" : 0,
"buckets" : [
{
"doc\_count" : 6,
"remoteadd" : {
"doc\_count\_error\_upper\_bound" : 0,
"sum\_other\_doc\_count" : 0,
"buckets" : [
{
"doc\_count" : 4,
"objects" : {
"doc\_count\_error\_upper\_bound" : 0,
"sum\_other\_doc\_count" : 0,
"buckets" : [
{
"doc\_count" : 1,
"key" : "abc"
},
{
"doc\_count" : 1,
"key" : "abc/abc"
},
{
"doc\_count" : 1,
"key" : "abc/abc-mirror"
},
{
"doc\_count" : 1,
"key" : "abc/abc-android"
}
]
},
"key" : "10.202.334.43"
},
{
"doc\_count" : 2,
"objects" : {
"doc\_count\_error\_upper\_bound" : 0,
"sum\_other\_doc\_count" : 0,
"buckets" : [
{
"doc\_count" : 2,
"key" : "abc/abc-main"
}
]
},
"key" : "54.45.543.23"
}
]
},
"key" : "[server1.domain.com](http://server1.domain.com)"
}
]
},
"key" : "pritib"
}
]
}
}
},
In aggregation result currently have only one user "pritib", but in future we may get more number of user .
Please help.
Thanks in advance.
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [November 6, 2020, 12:45pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523/2 "2020-11-06T12:45:56Z")
I think you should use key instead of keys
```auto
ctx.payload.aggregations.user.buckets
```
---
### Author:  [@priti](https://discuss.elastic.co/u/priti)
#### Post date: [November 7, 2020, 8:36pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523/3 "2020-11-07T20:36:57Z")
> [@priti](#):
>
> ctx.payload.aggregations.user.buckets.key
I tried with ctx.payload.aggregations.user.buckets.key also but it is not working.
Actually I have to take ctx.payload.aggregations.user.buckets.key in email action and sent email to respective key [user with there details for that i have to use foreach]
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [November 7, 2020, 10:10pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523/4 "2020-11-07T22:10:46Z")
This is your buckets array : ctx.payload.aggregations.user.buckets ? It should be used with foreach simply
---
### Author:  [@priti](https://discuss.elastic.co/u/priti)
#### Post date: [November 9, 2020, 9:27am UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523/5 "2020-11-09T09:27:38Z")
yes. When I have used
"log":{
"foreach" : "ctx.payload.aggregations.user.buckets",
"logging":{
"text":" {{#ctx.payload.aggregations.user.buckets}}{{key}} {{/ctx.payload.aggregations.user.buckets}} "
}
}
It is giving below error ,
"actions" : [
{
"id" : "log",
"type" : "logging",
"status" : "failure",
"error" : {
"root\_cause" : [
{
"type" : "exception",
"reason" : "specified foreach object was null: [ctx.payload.aggregations.user.buckets]"
}
],
"type" : "exception",
"reason" : "specified foreach object was null: [ctx.payload.aggregations.user.buckets]"
}
},
---
### Author:  [@ylasri](https://discuss.elastic.co/u/ylasri)
#### Post date: [November 9, 2020, 9:29am UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523/6 "2020-11-09T09:29:37Z")
Can you share your full watcher ?
---
### Author:  [@priti](https://discuss.elastic.co/u/priti)
#### Post date: [November 9, 2020, 6:10pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523/7 "2020-11-09T18:10:58Z")
````auto
"trigger": {
"schedule": {
"cron": "0 0/60 * ? * *"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"log-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 1000,
"query": {
"bool": {
"must": [
{
"exists": {
"field": "current_user_"
}
}
],
"should": [
{
"match": {
"program": "XYZ"
}
}
],
"must_not": [
{
"match": {
"current_user_": "nil"
}
}
],
"filter": {
"range": {
"@timestamp": {
"gte": "now-4d",
"lte": "now"
}
}
}
}
},
"aggs": {
"user": {
"terms": {
"field": "current_user_.keyword",
"min_doc_count": 25
},
"aggs": {
"instance": {
"terms": {
"field": "instance_.keyword"
},
"aggs": {
"remoteadd": {
"terms": {
"field": "remote_address_.keyword"
},
"aggs": {
"repo": {
"terms": {
"field": "repo.keyword"
}
}
}
}
}
}
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 25
}
}
},
"actions": {
"send_email": {
"foreach" : "ctx.payload.aggregations.user.buckets",
"max_iterations" : 500,
"email": {
"profile": "standard",
"priority": "normal",
"to": [
"{{ctx.payload.aggregations.user.buckets}}{{key}}@domainname.com{{#ctx.payload.aggregations.user.buckets}}"
],
"subject": "Subject XXXXXX",
"body": {
"html": "Dear {{ctx.payload.aggregations.user.buckets}}{{key}}{{#ctx.payload.aggregations.user.buckets}},
Please find below details
| User | Blocked transaction count | Instance | Remote Address | Repo |
|---|
{{#ctx.payload.aggregations.user.buckets}} | {{key}} | {{doc_count}} | {{#instance.buckets}} {{key}} {{/instance.buckets}} | {{#instance.buckets}}{{#remoteadd.buckets}} {{key}} {{/remoteadd.buckets}}{{/instance.buckets}}
| {{#instance.buckets}}{{#remoteadd.buckets}}{{#repo.buckets}} {{key}} {{/repo.buckets}}{{/remoteadd.buckets}}{{/instance.buckets}}
|
{{/ctx.payload.aggregations.user.buckets}}
Regards
Application Monitoring Team
"
}
}
},
"log": {
"foreach" : "ctx.payload.aggregations.user.buckets",
"max_iterations" : 500,
"logging": {
"level": "info",
"text": " | User | Blocked transaction count | Instance | Remote Address | Repo |
|---|
{{#ctx.payload.aggregations.user.buckets}} | {{key}}@.com | {{doc_count}} | {{#instance.buckets}} {{key}} {{/instance.buckets}} | {{#instance.buckets}}{{#remoteadd.buckets}} {{key}} {{/remoteadd.buckets}}{{/instance.buckets}}
| {{#instance.buckets}}{{#remoteadd.buckets}}{{#repo.buckets}} {{key}} {{/repo.buckets}}{{/remoteadd.buckets}}{{/instance.buckets}}
|
{{/ctx.payload.aggregations.user.buckets}} "
}
}
}
}```
````
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2020, 6:11pm UTC](https://discuss.elastic.co/t/foreach-for-bucket-aggregation-in-watcher-not-working/254523/8 "2020-12-07T18:11:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.