# How to use aggregation fields in Watcher action body (with foreach loop)?

**URL:** https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758
**Category:** Elasticsearch
**Created:** [July 27, 2022, 2:03pm UTC](https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758 "2022-07-27T14:03:10Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![111238](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111238/32/57619_2.png) [@111238](https://discuss.elastic.co/u/111238)
#### Post date: [July 27, 2022, 2:03pm UTC](https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758/1 "2022-07-27T14:03:11Z")

</div>

Hi there.

I'm currently trying to create a watcher with foreach loop (per aggregation bucket).  
The actual loop works fine. Though, I have a problem accessing "ctx.payload.aggregations." to include a specific field from it in the body. Action is triggered and emails are generated, but without this data.

Here's the action:

```auto
  "actions": {
    "send_email": {
      "foreach" : "ctx.payload.aggregations.hosts.buckets",
      "email": {
        "profile": "standard",
        "to": [
          "some@mail"
        ],
        "subject": "POS Watcher",
        "body": {
          "text": "{{ctx.payload.aggregations.hosts.buckets._key}}"
        }
      }
    }
  }

```

And the aggregation itself:

```auto
        "aggregations": {
          "hosts": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "doc_count": 2,
                "min_term": {
                  "value": -402
                },
                "key": "l-kv-tych1o-016"
              },
              {
                "doc_count": 2,
                "min_term": {
                  "value": -620
                },
                "key": "l-rv-shuk12-045"
              }
            ]
          }
        }

```

Would really appreciate some help.

Regard, Yaroslav.

---

<div class="post-metadata">

### Author: ![111238](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/111238/32/57619_2.png) [@111238](https://discuss.elastic.co/u/111238)
#### Post date: [August 10, 2022, 8:20am UTC](https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758/2 "2022-08-10T08:20:17Z")

</div>

Ok, found it out by my own. Here's the solution, maybe it helps someone one day)

In foreach looping through buckets, each bucket itself becomes ctx.payload "root".  
This works as intended, returning specific field from each bucket:

```auto
  "actions": {
    "send_email": {
      "foreach" : "ctx.payload.aggregations.hosts.buckets",
      "email": {
        "profile": "standard",
        "to": [
          "some@mail"
        ],
        "subject": "POS Watcher",
        "body": {
          "text": "{{ctx.payload.key}}"
        }
      }
    }
  }

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2022, 8:20am UTC](https://discuss.elastic.co/t/how-to-use-aggregation-fields-in-watcher-action-body-with-foreach-loop/310758/3 "2022-09-07T08:20:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
