# Help with Watcher Script Transform

**URL:** <https://discuss.elastic.co/t/help-with-watcher-script-transform/171411>\
**Category:** Kibana\
**Created:** [March 8, 2019, 2:47am UTC](https://discuss.elastic.co/t/help-with-watcher-script-transform/171411 "2019-03-08T02:47:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [March 8, 2019, 2:47am UTC](https://discuss.elastic.co/t/help-with-watcher-script-transform/171411/1 "2019-03-08T02:47:15Z")

</div>

I am trying to pass some data from a watcher to another index. I was looking to use the Script Transform with Index Action to insert data from the watch. With this code, I'm getting a "could not parse action [_inlined_/transform]. unknown action type [script]" error.

Any ideas?

```
   "actions": {
      "transform" : {
         "script" : {
            "inline" : "return ['@timestamp':ctx.triggered_time]", 
            "lang" : "painless"
         }
      },
      "index" : {
         "index" : "alerts-*",
         "doc_type" : "doc"
          }
        }
```

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [March 8, 2019, 5:35pm UTC](https://discuss.elastic.co/t/help-with-watcher-script-transform/171411/2 "2019-03-08T17:35:34Z")

</div>

> [@uklipse](#):
>
> could not parse action [_inlined_ /transform]. unknown action type [script]" error

@Alexander_Reelsen - an you please help here ?

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![uklipse](https://avatars.discourse-cdn.com/v4/letter/u/cdc98d/32.png) [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Post date:** [March 9, 2019, 4:22am UTC](https://discuss.elastic.co/t/help-with-watcher-script-transform/171411/3 "2019-03-09T04:22:41Z")

</div>

Here is the full code if it helps.

```
POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "1m"
      }
    },
    "input": {
      "search": {
        "request": {
          "indices" : [
            "winlogs-*"
            ],
          "body": {
            "size": 3,
            "query": {
              "bool": {
                "must" : [{
                  "match" : {
                     "event_id" : "4624" 
                     }
                  }, {
                  "range" : {
                     "@timestamp" : {
                        "gte" : "now-1h" 
                     }
                   }
                }]
                }
               },
               "aggs" : {
                 "workstation" : {
                   "terms": {
                     "field" : "event_data.WorkstationName"
                 }
                  }
                 }
               }
             }
          }
        },
        "condition" : {
          "compare" : {
            "ctx.payload.aggregations.workstation.buckets.0.doc_count" : {"gt" : 6}
          }
        },
       "actions": {
          "transform" : {
             "script" : {
                "inline" : "return ['@timestamp':ctx.triggered_time]", 
                "lang" : "painless"
             }
          },
          "index" : {
             "index" : "alerts-*",
             "doc_type" : "doc"
              }
            }
          }
      }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2019, 4:31am UTC](https://discuss.elastic.co/t/help-with-watcher-script-transform/171411/4 "2019-04-06T04:31:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.