# How to pass result of one chained input, into next chained input
**URL:** https://discuss.elastic.co/t/how-to-pass-result-of-one-chained-input-into-next-chained-input/328069
**Category:** Kibana
**Tags:** painless
**Created:** [March 20, 2023, 12:07pm UTC](https://discuss.elastic.co/t/how-to-pass-result-of-one-chained-input-into-next-chained-input/328069 "2023-03-20T12:07:03Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@bhavya](https://discuss.elastic.co/u/bhavya)
#### Post date: [March 20, 2023, 12:07pm UTC](https://discuss.elastic.co/t/how-to-pass-result-of-one-chained-input-into-next-chained-input/328069/1 "2023-03-20T12:07:03Z")
I am writing a watcher, to first fetch `destination.ip` field (using aggregation), and then I have to use 1st input result for terms query value (in 3rd input)
```auto
POST _watcher/watch/_execute
{
"watch": {
"trigger": {
"schedule": {
"interval": "10s"
}
},
"input": {
"chain": {
"inputs": [
{
"first": {
"search": {
"request": {
"indices": [
"test-index"
],
"body": {
"size": 0,
"aggs": {
"destination_ip_aggs": {
"terms": {
"field": "destination.ip",
"size": 2
}
}
}
}
}
}
}
},
{
"second": {
"transform": {
"script": {
"lang": "painless",
"source": """
List ips = new ArrayList();
for(def bucket: ctx.payload.first.aggregations.destination_ip_aggs.buckets) {
ips.add(bucket.key)
}
return ips;
"""
}
}
}
},
{
"third": {
"search": {
"request": {
"indices": [
"test-index"
],
"body": {
"query": {
"terms": {
"source.ip": [
"{{ctx.payload.second._value}}"
]
}
}
}
}
}
}
}
]
}
},
"actions": {
"log_error": {
"logging": {
"text": "{{ctx.payload.second._value}}"
}
}
}
}
}
```
The watcher output is like
```auto
"chain" : {
"first" : {
"type" : "search",
"status" : "success",
"payload" : {
"_shards" : {
"total" : 1,
"failed" : 0,
"successful" : 1,
"skipped" : 0
},
"hits" : {
"hits" : [],
"total" : 2,
"max_score" : null
},
"took" : 1,
"timed_out" : false,
"aggregations" : {
"destination_ip_aggs" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"doc_count" : 1,
"key" : "10.20.70.200"
},
{
"doc_count" : 1,
"key" : "10.20.70.210"
}
]
}
}
},
"search" : {
"request" : {
"search_type" : "query_then_fetch",
"indices" : [
"test-index"
],
"rest_total_hits_as_int" : true,
"body" : {
"size" : 0,
"aggs" : {
"destination_ip_aggs" : {
"terms" : {
"field" : "destination.ip",
"size" : 2
}
}
}
}
}
}
},
"second" : {
"type" : "transform",
"status" : "success",
"payload" : {
"_value" : [
"10.20.70.200",
"10.20.70.210"
]
}
},
"third" : {
"type" : "search",
"status" : "failure",
"error" : {
"root_cause" : [
{
"type" : "query_shard_exception",
"reason" : "failed to create query: '{0=10.20.70.200, 1=10.20.70.210}' is not an IP string literal.",
"index_uuid" : "cH54bWHPTa2V2i9SskRPhw",
"index" : "test-index"
}
],
"type" : "search_phase_execution_exception",
"reason" : "all shards failed",
"phase" : "query",
"grouped" : true,
"failed_shards" : [
{
"shard" : 0,
"index" : "test-index",
"node" : "5sTXsEnqRFabKkXTrUiPBA",
"reason" : {
"type" : "query_shard_exception",
"reason" : "failed to create query: '{0=10.20.70.200, 1=10.20.70.210}' is not an IP string literal.",
"index_uuid" : "cH54bWHPTa2V2i9SskRPhw",
"index" : "test-index",
"caused_by" : {
"type" : "illegal_argument_exception",
"reason" : "'{0=10.20.70.200, 1=10.20.70.210}' is not an IP string literal."
}
}
}
]
},
"search" : {
"request" : {
"search_type" : "query_then_fetch",
"indices" : [
"test-index"
],
"rest_total_hits_as_int" : true,
"body" : {
"query" : {
"terms" : {
"source.ip" : [
"{0=10.20.70.200, 1=10.20.70.210}"
]
}
}
}
}
}
}
}
```
**How can I use the second input value, in the third input (for terms query)? I tried to transform the data again, but still not able to get it in the correct list format.**
Can anyone please help me resolve this ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 17, 2023, 12:07pm UTC](https://discuss.elastic.co/t/how-to-pass-result-of-one-chained-input-into-next-chained-input/328069/2 "2023-04-17T12:07:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.