# How do I route a joined document in a Watcher index action?

**URL:** <https://discuss.elastic.co/t/how-do-i-route-a-joined-document-in-a-watcher-index-action/368314>\
**Category:** Elastic Observability\
**Created:** [October 6, 2024, 5:10pm UTC](https://discuss.elastic.co/t/how-do-i-route-a-joined-document-in-a-watcher-index-action/368314 "2024-10-06T17:10:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gary\_Brooks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_brooks/32/123130_2.png) [@Gary\_Brooks](https://discuss.elastic.co/u/Gary_Brooks)\
**Post date:** [October 6, 2024, 5:10pm UTC](https://discuss.elastic.co/t/how-do-i-route-a-joined-document-in-a-watcher-index-action/368314/1 "2024-10-06T17:10:36Z")

</div>

I have start and end events in a joined index, where the join is from the end event to the start event. Elastic agents relay events from a Spark system to a Logstash pipeline, which then injects the events into the index seamlessly. Subsequently, I match the end events to their corresponding start events through a Watcher, using bulk index updates with the "\_doc": idiom. Due to the joined nature of the index, it is necessary to specify the routing in the index action to ensure that a parent and its child are co-located on the same shard.

One approach I tried was to add a "\_routing" field alongside the "\_id" field to the documents within the \_doc array. However, this results in errors such as:

"org.elasticsearch.index.mapper.MapperParsingException: failed to parse field [\_routing] of type [\_routing] in document with id '8d363b90a99c5a9232f20ab08d5eecb636aeee30'. Preview of field's value: 'be28b73764a6ea562ead49b3153a67568d8e7c08'"

The standard method to route a document in a Watcher index action is unclear, and it is uncertain if this use case has been implemented. Guidance on the correct approach is sought.

Below is the template for the index for reference. Additional details and specific examples can be provided upon request.

```auto
{
  "index_patterns": ["batch-active-index-*"],
  "priority": 200,
  "template": {
    "settings": {
      "index.number_of_shards": 1,
      "number_of_replicas": 1,
      "index.lifecycle.name": "batch-active",
      "index.lifecycle.rollover_alias": "batch-active-index"
    },
    "mappings": {
      "properties": {
        "@timestamp": {"type": "date"},
        "realm": {"type": "keyword"},
        "batch_class": {"type": "keyword"},
        "event_kind": {"type": "keyword"},
        "event_name": {"type": "text"},
        "event_id": {"type": "keyword"},
        "matched": {"type": "boolean"},
        "log_timestamp": {"type": "date"},
        "start_millis": {"type": "unsigned_long"},
        "end_millis": {"type": "unsigned_long"},
        "duration": {"type": "long"},
        "uid": {"type": "keyword"},
        "start_uid": {"type": "keyword"},
        "start_end": {"type": "join", "relations": {"start": "end"}}
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Gary\_Brooks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gary_brooks/32/123130_2.png) [@Gary\_Brooks](https://discuss.elastic.co/u/Gary_Brooks)\
**Post date:** [October 12, 2024, 2:19pm UTC](https://discuss.elastic.co/t/how-do-i-route-a-joined-document-in-a-watcher-index-action/368314/2 "2024-10-12T14:19:06Z")

</div>

It would be great if I could get a response from someone who has an understanding of Watcher and joined indices.