# How to compare numeric field in the watcher condition

**URL:** <https://discuss.elastic.co/t/how-to-compare-numeric-field-in-the-watcher-condition/49866>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 12, 2016, 8:30am UTC](https://discuss.elastic.co/t/how-to-compare-numeric-field-in-the-watcher-condition/49866 "2016-05-12T08:30:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leopit](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@leopit](https://discuss.elastic.co/u/leopit)\
**Post date:** [May 12, 2016, 8:30am UTC](https://discuss.elastic.co/t/how-to-compare-numeric-field-in-the-watcher-condition/49866/1 "2016-05-12T08:30:13Z")

</div>

I am collecting traffic information per every second.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f68ba602ba94a56e72c5e121a74db2c60c71474c.png)

I'd like to compare the inoutbps field  
if the traffic(bpsinout field) value goes over than 5000000, I hope get a notification

## i tried to write watcher like below, but I don't know if this sentence is right or not.

## curl -XPUT '[http://localhost2:9200/\_watcher/watch/log\_threshold\_watch](http://localhost2:9200/_watcher/watch/log_threshold_watch)' -d '{ "trigger" : { "schedule" : { "interval" : "10s" } }, "input" : { "search" : { "request" : { "indices" : ["traffic-\*"], "body" : { "query" : { "match" : { "type": "TOTAL\_PROTOCOL" } } } } } }, "condition" : { "compare" : { "doc.bpsinout.value" : { "gt" : 5000000 }} }, "actions" : { "send\_email" : { "email" : { "to" : "leopit.kr@gmail.com", "subject" : "threshold alert", "body" : "threshold alert" } } } }'

Actually, I don't know what the name of inoutbps field is.  
doc.bpsinout.value right? I think it is wrong,

How to compare inoutbps value in the watcher?

Anybody help me.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 13, 2016, 6:51am UTC](https://discuss.elastic.co/t/how-to-compare-numeric-field-in-the-watcher-condition/49866/2 "2016-05-13T06:51:50Z")

</div>

Hey,

there are some mentions in the [compare condition](https://www.elastic.co/guide/en/watcher/current/condition.html#condition-compare).

You need to access the `ctx.payload`, which contains the JSON structure of the search response. So you need sth like `ctx.payload.hits.hits.0.inoutbps` if you want to get the value from the first document in the hits array.

Hope this helps!

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/how-to-compare-numeric-field-in-the-watcher-condition/49866/3 "2017-07-06T13:45:36Z")

</div>