# Getting only items from "array\_compare" condition is met

**URL:** <https://discuss.elastic.co/t/getting-only-items-from-array-compare-condition-is-met/123959>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [March 14, 2018, 5:19pm UTC](https://discuss.elastic.co/t/getting-only-items-from-array-compare-condition-is-met/123959 "2018-03-14T17:19:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![saranyav](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@saranyav](https://discuss.elastic.co/u/saranyav)\
**Post date:** [March 14, 2018, 5:19pm UTC](https://discuss.elastic.co/t/getting-only-items-from-array-compare-condition-is-met/123959/1 "2018-03-14T17:19:47Z")

</div>

Hello Everyone,

I am trying to get IP-address that is been used to register more that 2 users and flag the IP as anomolous.  
I tried to do "aggs" by grouping by IPaddress with the "array\_compare" condition.  
Once the condition is met on some of my array values, I need the related action to take only those values and not all of them for reporting purposes.

Condition:

```
 "condition": {
    "array_compare": {
      "ctx.payload.aggregations.group_by_ip.buckets": {
        "path": "doc_count",
        "gte": {
          "value": 2,
          "quantifier": "some"
        }
      }
    }
  }

```

Here is my action:

```
"actions": {
    "email_administrator": {
        "email": {
        "profile": "standard",
        "from": "' ****'",
        "priority": "high",
        "to": [
          "'***'"
        ],
        "subject": "Model - Encountered Multiple SUR - Successful User Registration",
        "body": {
          "text": "The IP [{{#ctx.payload.aggregations.group_by_ip.buckets}}{{key}} {{/ctx.payload.aggregations.group_by_ip.buckets}}] spiked usage with [{{#ctx.payload.aggregations.group_by_ip.buckets}}{{doc_count}} {{/ctx.payload.aggregations.group_by_ip.buckets}}]"
        }
      }
    }
  }

```

I see from other posts that I need to do script transform that does this filtering. Can anyone please provide me sample of how to do that?

Appreciate your help!

Thanks!  
SV

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [March 15, 2018, 9:10pm UTC](https://discuss.elastic.co/t/getting-only-items-from-array-compare-condition-is-met/123959/2 "2018-03-15T21:10:15Z")

</div>

Hey,

you need to do another script transform here, something like

```auto
ctx.payload.aggregations.group_by_ip.buckets.stream().filter(b -> b.doc_count > 2).collect(Collectors.toList));

```

however some aggregations also support the `min_doc_count` parameter, which could be used instead, allowing you to check if there are any buckets at all and not needing to do any manual filtering.

--Alex

---

<div class="post-metadata">

**Author:** ![saranyav](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@saranyav](https://discuss.elastic.co/u/saranyav)\
**Post date:** [March 19, 2018, 6:37pm UTC](https://discuss.elastic.co/t/getting-only-items-from-array-compare-condition-is-met/123959/3 "2018-03-19T18:37:57Z")

</div>

Hello Alex,

Appreciate your response. This is one awesome forum!!!

I was able to a transform like below.

```
  "transform": {
        "script": {
          "source": "List l = new ArrayList(); int count=1; for(item in ctx.payload.aggregations.group_by_email.buckets) { if(item.doc_count>1){l.add(item); count++;}} return ['user_info':l];",
          "lang": "painless"
        }
      }

```

I know this overwrites the original payload, I need some information from original payload.

This transform will get me Ip-addresses that is been used to register more than 2 users.The transformed payload only has IPaddress and doc\_count, now I need email\_address for these records that is there in original payload.

How can I get the information in the original payload along with the aggregations payload?

Thanks!  
SV

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [March 19, 2018, 8:11pm UTC](https://discuss.elastic.co/t/getting-only-items-from-array-compare-condition-is-met/123959/4 "2018-03-19T20:11:43Z")

</div>

hey,

you can just attach the original payload as well, like

```auto
x = ctx.payload;
x.user_info = l;
return x;

```

---

<div class="post-metadata">

**Author:** ![saranyav](https://avatars.discourse-cdn.com/v4/letter/s/977dab/32.png) [@saranyav](https://discuss.elastic.co/u/saranyav)\
**Post date:** [March 28, 2018, 3:01pm UTC](https://discuss.elastic.co/t/getting-only-items-from-array-compare-condition-is-met/123959/5 "2018-03-28T15:01:55Z")

</div>

Hey Alex,

That worked. Thanks so much.

SV

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2018, 3:02pm UTC](https://discuss.elastic.co/t/getting-only-items-from-array-compare-condition-is-met/123959/6 "2018-04-25T15:02:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.