# How to save "total hits" results from a query, in a field

**URL:** <https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807>\
**Category:** Logstash\
**Created:** [February 21, 2024, 4:06pm UTC](https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807 "2024-02-21T16:06:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andex](https://avatars.discourse-cdn.com/v4/letter/a/848f3c/32.png) [@Andex](https://discuss.elastic.co/u/Andex)\
**Post date:** [February 21, 2024, 4:06pm UTC](https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807/1 "2024-02-21T16:06:25Z")

</div>

Hi, i 'm trying to using Logstash to send email.  
I configure the input pipeline filter witha a query, i need to find all the document that contain ERROR in the message.

I do that.  
in the output i want to user the total hits value that is contained in the query results, to create a condition : if "total\_hits \> 10" -\> send me the email.

This is the pipeline :

```auto
  input {
      elasticsearch {
        hosts => ["https:// *********** :9200"]
              index => "tibcolog-gpf-*"
              query => '{"query": {"bool": {"filter": [{"bool": {"should": [{"match_phrase": {"logger_type": "ERROR"}}]}},{"range": {"@timestamp": {"format": "strict_date_optional_time","gte": "now-15m","lte": "now"}}}]}}}'
              ssl => true
              ssl_certificate_verification => false
              user => "logstash_writer"
              password => " **********"
              schedule => "*/15 * * * *"
        }
  }

  output {
    if [hits][total] > 10 {
        email {
        to => " ********"
        address => " ********"
        authentication => "plain"
        subject => "TEST ERROR"
        body => "Il Log in errore è:%{message}"
        port => "25"
        }
        }
    }

```

My pipeline is on Kubernetes, it is running but it crash (restarting) when the query start .

is i remove the IF condition in the ooutput, it work good.  
Somone can tell me how to use the hits for my case??

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 21, 2024, 5:40pm UTC](https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807/2 "2024-02-21T17:40:53Z")

</div>

Does the field exist? See [this](https://discuss.elastic.co/t/comparing-number-in-conditionnal-event-treatement/217043/5) thread.

---

<div class="post-metadata">

**Author:** ![Andex](https://avatars.discourse-cdn.com/v4/letter/a/848f3c/32.png) [@Andex](https://discuss.elastic.co/u/Andex)\
**Post date:** [February 22, 2024, 8:20am UTC](https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807/3 "2024-02-22T08:20:45Z")

</div>

No, the field (total hits) does not exist. i thought too that could be the error. But how i can save the total hits to a new field?

I can use a mutate filter with add\_field but how can i populate it?  
i hoped that there was a way to use the number of total\_hits of the query output

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 22, 2024, 8:26am UTC](https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807/4 "2024-02-22T08:26:00Z")

</div>

I have no idea. If the elasticsearch query does not populate that field that I cannot say how you could create it from the event that the elasticsearch input creates.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2024, 8:26am UTC](https://discuss.elastic.co/t/how-to-save-total-hits-results-from-a-query-in-a-field/353807/5 "2024-03-21T08:26:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.