# How put 2 scripts in a watcher

**URL:** <https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting\
**Created:** [October 16, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350 "2020-10-16T13:29:36Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [October 16, 2020, 1:29pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350/1 "2020-10-16T13:29:36Z")

</div>

**hello how can i put 2 scripts in an alert? i have one that is from "ctx.payload.time\_triggered" and the other is for "metric.agg". i need help with this...**

```auto
{
  "trigger": {
    "schedule": {
      "interval": "1h"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "agenteallot*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                      "lte": "{{ctx.trigger.scheduled_time}}",
                      "format": "strict_date_optional_time||basic_time_no_millis"
                    }
                  }
                },
                {
                  "term": {
                    "monitor.name.keyword": "01-2-CAV3000006278-DATOS-BKP-2.7G-99.98"
                  }
                }
              ]
            }
          },
          "aggs": {
            "metricAgg": {
              "max": {
                "field": "summary.up"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "if (ctx.payload.aggregations.metricAgg.value >= params.threshold) { return true; } return false;",
      "lang": "painless",
      "params": {
        "threshold": 0.8
      }
    }
  },
  "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "json"
        },
        "to": [
          "juan.jaramillo@megadvantage.com",
          "juancho.jaramillo16@gmail.com",
          "jose.caceresg@etb.com.co",
          "victor.vera@megadvantage.com"
        ],
        "subject": "{{ctx.metadata.name}} 01-2-CAV3000006278-DATOS-BKP-2.7G-99.98",
        "body": {
          "text": """Buen dia, Adjunto registro del reporte.

 ⚠️ALERTA NODO!!! El siguiente enlace perdió la conexión. 

 Estado: Down🔴 

 Nombre del Enlace: 01-2-CAV3000006278-DATOS-BKP-2.7G-99.98

 🕧Hora: {{ctx.payload.time_triggered}} {{ctx.result.execution_time}}

 Área: Networking 

 🔔Mensaje Alerta: El enlace ha dejado de responder. Responder correo a telecomunicaciones@udistrital.edu.co 

 Ingrese aquí para más información: https://72dfe17217744236af40cc31b704a664.us-central1.gcp.cloud.es.io:9243/s/distrital/app/uptime#"""
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "return ['time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))]",
      
      "lang": "painless",
       "script": {
      "source": "HashMap result = new HashMap(); result.result = ctx.payload.aggregations.metricAgg.value; return result;",
      "lang": "painless",
      "params": {
        "threshold": 0.8
      }
    }
    }
  }
}

```

**ERROR Simulation output...**

 ![Screenshot 2020-10-16 082427](https://us1.discourse-cdn.com/elastic/original/3X/2/3/23d3ada988150c72839f72c50df4bd635358ac7b.png)

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 16, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350/2 "2020-10-16T13:58:02Z")

</div>

Take a look at the [chain transform](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/transform-chain.html) or merge the two scripts into one.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [October 16, 2020, 2:01pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350/3 "2020-10-16T14:01:59Z")

</div>

How do I do that? sorry men

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [October 16, 2020, 2:08pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350/4 "2020-10-16T14:08:53Z")

</div>

**It doesn't work that way.**

```auto
 "transform": {
      "chain": [
  {
    "script": {
      "source": "return ['time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))]",
      
      "lang": "painless",
       "script": {
      "source": "HashMap result = new HashMap(); result.result = ctx.payload.aggregations.metricAgg.value; return result;",
      "lang": "painless",
      "params": {
        "threshold": 0.8
}
}
}
}
]
}
}

```

**error:**

```auto
[x_content_parse_exception] [1:1817] [script] unknown field [script]

```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 16, 2020, 2:14pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350/5 "2020-10-16T14:14:36Z")

</div>

Please take your time read the documentation again. Just copy pasting your previous code will not work. Take your time to understand the JSON structure of a chained transform instead of trying to make everything work by copy paste.

If the docs are hard to understand, we have to fix the docs, but I get the feeling you are using this forum to dump all your questions and expect ready-made answers that you can actually copy & paste. This is not how this forum works. It's about helping by making sure you fully understand how this works and this implies that you have taken the time to read the documentation properly and get familiar with all the concepts.

Readers in this forum are here to help (on a completely voluntary base, if you need commercial grade support with SLAs, you can get that as well), but this goes into both directions.

Thank you.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [October 16, 2020, 2:21pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350/6 "2020-10-16T14:21:08Z")

</div>

is that i already read it but the example that gives the documentation is of a script with a search, and i need to put two scripts but i get the unknown field error of the script and i put it nested. for that reason i resort to the forum because there are things that do not appear in google that one can take into account. but i have not seen a watcher that has two scripts, there is no example of that to have.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2020, 2:21pm UTC](https://discuss.elastic.co/t/how-put-2-scripts-in-a-watcher/252350/7 "2020-11-13T14:21:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
