# Hit results of watcher always returns the same value

**URL:** <https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 5, 2020, 8:09am UTC](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926 "2020-02-05T08:09:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Noureddine\_Brahmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/noureddine_brahmi/32/62092_2.png) [@Noureddine\_Brahmi](https://discuss.elastic.co/u/Noureddine_Brahmi)\
**Post date:** [February 5, 2020, 8:09am UTC](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926/1 "2020-02-05T08:09:35Z")

</div>

I noticed since I upgraded to elasticsearch 7.5, that the hit results of my watcher always return the same value "10000", no matter what condition or query I use in the watcher.

I feel like there is come kind of maximum set, but I can't put my finger on where. Because the same query executed on elasticsearch returns way more than 10000 hits.

Exemple of my watcher:

> {  
> "trigger": {  
> "schedule": {  
> "interval": "10m"  
> }  
> },  
> "input": {  
> "search": {  
> "request": {  
> "search\_type": "query\_then\_fetch",  
> "indices": [  
> "TEST"  
> ],  
> "rest\_total\_hits\_as\_int": true,  
> "body": {  
> "size": 0,  
> "query": {  
> "bool": {  
> "must": [  
> {  
> "term": {  
> "result\_err": "80"  
> }  
> },  
> {  
> "range": {  
> "@timestamp": {  
> "gte": "now-60m"  
> }  
> }  
> }  
> ]  
> }  
> },  
> "sort": [  
> {  
> "@timestamp": {  
> "order": "desc"  
> }  
> }  
> ]  
> }  
> }  
> }  
> },  
> "condition": {  
> "compare": {  
> "ctx.payload.hits.total": {  
> "gt": 1  
> }  
> }  
> },  
> "actions": {  
> "email\_admin": {  
> "email": {  
> "profile": "standard",  
> "priority": "high",  
> "to": [  
> "[test@test.com](mailto:test@test.com)"  
> ],  
> "subject": "testtest",  
> "body": {  
> "text": "tototest"  
> }  
> }  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 5, 2020, 9:08am UTC](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926/2 "2020-02-05T09:08:12Z")

</div>

Have a look at [https://www.elastic.co/guide/en/elasticsearch/reference/7.5/search-request-body.html#request-body-search-track-total-hits](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/search-request-body.html#request-body-search-track-total-hits)

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 5, 2020, 9:18am UTC](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926/3 "2020-02-05T09:18:50Z")

</div>

I think `rest_total_hits_as_int` is a wrong parameter

---

<div class="post-metadata">

**Author:** ![Noureddine\_Brahmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/noureddine_brahmi/32/62092_2.png) [@Noureddine\_Brahmi](https://discuss.elastic.co/u/Noureddine_Brahmi)\
**Post date:** [February 5, 2020, 9:21am UTC](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926/4 "2020-02-05T09:21:12Z")

</div>

Thank you! I resolved the problem by adding

> "track\_total\_hits": true,

I appriciate the quick answers!

---

<div class="post-metadata">

**Author:** ![Noureddine\_Brahmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/noureddine_brahmi/32/62092_2.png) [@Noureddine\_Brahmi](https://discuss.elastic.co/u/Noureddine_Brahmi)\
**Post date:** [February 5, 2020, 9:22am UTC](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926/5 "2020-02-05T09:22:06Z")

</div>

Yes, I think so too. I'll remove it. Thanks 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 4, 2020, 9:22am UTC](https://discuss.elastic.co/t/hit-results-of-watcher-always-returns-the-same-value/217926/6 "2020-03-04T09:22:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.