# How to compare ctx.payload.hits.total value to last ctx.payload.hits.total

**URL:** <https://discuss.elastic.co/t/how-to-compare-ctx-payload-hits-total-value-to-last-ctx-payload-hits-total/130756>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 6, 2018, 5:02pm UTC](https://discuss.elastic.co/t/how-to-compare-ctx-payload-hits-total-value-to-last-ctx-payload-hits-total/130756 "2018-05-06T17:02:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\
**Post date:** [May 6, 2018, 5:02pm UTC](https://discuss.elastic.co/t/how-to-compare-ctx-payload-hits-total-value-to-last-ctx-payload-hits-total/130756/1 "2018-05-06T17:02:15Z")

</div>

HI @spinscale

is their any way of comparing one ctx.payload.hits.total to another ctx.payload.hits.total

like current value of ctx.payload.hits.total to last value of ctx.payload.hits.total for a watcher

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 7, 2018, 7:21am UTC](https://discuss.elastic.co/t/how-to-compare-ctx-payload-hits-total-value-to-last-ctx-payload-hits-total/130756/2 "2018-05-07T07:21:26Z")

</div>

you would need to query the corresponding watcher history index and get the last run of the watch. The history index contains a record for each watch execution that is triggered in the background. This watch execution will also contain the previous payload.

However, you could also run the same query with different range queries in a `chained` input and achieve the same results by then comparing the hits with each other.

--Alex

---

<div class="post-metadata">

**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\
**Post date:** [May 7, 2018, 7:46pm UTC](https://discuss.elastic.co/t/how-to-compare-ctx-payload-hits-total-value-to-last-ctx-payload-hits-total/130756/3 "2018-05-07T19:46:00Z")

</div>

> [@spinscale](#):
>
> watcher history index

Hi Alex

thanks for your reply

below is my simple query:

{  
"trigger": {  
"schedule": {  
"interval": "1h"  
}  
},  
"input": {  
"search": {  
"request": {  
"body": {  
"size": 0,  
"query": {  
"match\_phrase" : {  
"message" : "Failed password for invalid user"  
}

```
  }
},
"indices": [
  "*"
]

```

}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gte": 1  
}  
}  
},

"actions" : {  
"gmail\_account": {  
"email": {  
"profile": "standard",  
"to": [  
"[testemail@gmail.com](mailto:testemail@gmail.com)"  
],  
"subject": "ELK Alert: Failed logging attempts Detected !",  
"body": {  
"text" : "WARNING: There are {{ctx.payload.hits.total}} Failed logging attempts Detected in last 1 Hour. "  
}  
}  
},  
"my-logging-action": {  
"logging": {  
"text" : "WARNING: There are {{ctx.payload.hits.total}} Failed logging attempts Detected in last 1 Hour. "  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 8, 2018, 7:53am UTC](https://discuss.elastic.co/t/how-to-compare-ctx-payload-hits-total-value-to-last-ctx-payload-hits-total/130756/4 "2018-05-08T07:53:13Z")

</div>

You just pasted some snippet - please take your time to properly format this, this is super hard to read and it is pretty simple to just use markdown to format it.

What is your actual question here?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 5, 2018, 7:53am UTC](https://discuss.elastic.co/t/how-to-compare-ctx-payload-hits-total-value-to-last-ctx-payload-hits-total/130756/5 "2018-06-05T07:53:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.