Hi,
we are trying to create a new watcher for getting total value in perticular field for that which value is select in aggregations.
"aggs": {
"abc": {
"filter": {
"term": {
"field": "abc"
in abc place we need display total field value.
In this guide in Elastic documentation there is an example on a watcher alert is set up including aggregations
The aggregation data (ctx.payload.aggregations.group_by_city.buckets) is used in the action email, but not in the alert condition but it should be accessible as well.
Hope it helps.