# Index action - document construction **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [May 22, 2015, 3:55pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181 "2015-05-22T15:55:49Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![karol\_brejna](https://avatars.discourse-cdn.com/v4/letter/k/e99b99/32.png) [@karol\_brejna](https://discuss.elastic.co/u/karol_brejna)\ **Post date:** [May 22, 2015, 3:55pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/1 "2015-05-22T15:55:49Z")
I wanted to use index action. The initial payload in the index action is quite a big one. I'd like to construct smaller doc to be inserted. Actions like logging or email allow for using templates: ``` "logging" : { "text" : "executed at {{ctx.execution_time}}" } ``` It doesn't seem to be the case with index action. So I would probably need use transform ability it provides. I see in the docs ([https://www.elastic.co/guide/en/watcher/current/anatomy-transform.html](https://www.elastic.co/guide/en/watcher/current/anatomy-transform.html)) that there are two types (3 including 'chain') of transforms: script and search. Wouldn't it be useful to be able to use templates to create my own doc? For example by having dedicated field for all 'injected' attributes, like this: ``` "actions" : { "index_payload" : { "transform: { }, "index" : { "index" : "my-index", "doc_type" : "my-type" }, "doc": { "executedAt" : "executed at {{ctx.execution_time}}", "field1": "some simple text with {{ctx.some_expresion}}" } } } ``` Come to think of it, a transformation of this kind (document builder, or something) would be even more useful. At least I think so..... 😄 What do you think? Regards, Karol ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [May 22, 2015, 5:25pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/2 "2015-05-22T17:25:22Z")
I like it! totally makes sense for the cases where you don't need control flow logic, in which a template is much more readable. Thanks Karol for the suggestion! ---
**Author:** ![rabx88](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@rabx88](https://discuss.elastic.co/u/rabx88)\ **Post date:** [May 26, 2015, 6:01pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/3 "2015-05-26T18:01:23Z")
On a similar note, If I do something like this to save a piece of data using the index action, it nests the results under "data": {"\_value": ``` "actions": { "index_payload": { "transform": { "script" : "return ctx.payload.hits.hits*._source" }, "index": { "index": "issues", "doc_type": "issue" } } } ``` Produces: ``` "_source":{ "data" : { "_value" : [ { "@timestamp" : "2015-05-26T17:41:38.2002937Z", "_type" : "processor", "processor" : { "PercentProcessorTime" : 90, } } ] } ``` Is there a way to avoid this behavior? If I need to satisfy an existing model this is problematic. ---
**Author:** ![GaelTadh](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@GaelTadh](https://discuss.elastic.co/u/GaelTadh)\ **Post date:** [May 26, 2015, 7:38pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/4 "2015-05-26T19:38:09Z")
If you return a map from the script you should be able to adhere to whatever model you need. See [https://www.elastic.co/guide/en/watcher/current/anatomy-transform.html#anatomy-transform-script](https://www.elastic.co/guide/en/watcher/current/anatomy-transform.html#anatomy-transform-script) ---
**Author:** ![Patrik\_Pompe](https://avatars.discourse-cdn.com/v4/letter/p/8baadc/32.png) [@Patrik\_Pompe](https://discuss.elastic.co/u/Patrik_Pompe)\ **Post date:** [May 28, 2015, 2:43pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/5 "2015-05-28T14:43:14Z")
I tried to use watcher in this way: 1. initial payload is search request with some aggregations 2. as a watcher action I wanted to index aggregation buckets in way "1 bucket from search response results in 1 new indexed document" but I got in trouble with mentioned `"data": {"_value": structure...` - which doesn't fit required mapping, I need unwrap this "data" field wrapper. Is possible to create transform script which leads to required behavior - multiple new indexed documents? ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [May 28, 2015, 9:51pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/6 "2015-05-28T21:51:12Z")
Oh.. interesting. We currently don't support indexing multiple docs per a single action, but I love the idea. So for example, if the payload is an array, we can treat each element of the array as a document and bulk index it... nice one! ---
**Author:** ![Patrik\_Pompe](https://avatars.discourse-cdn.com/v4/letter/p/8baadc/32.png) [@Patrik\_Pompe](https://discuss.elastic.co/u/Patrik_Pompe)\ **Post date:** [May 29, 2015, 7:10am UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/7 "2015-05-29T07:10:10Z")
Thanks GaelTadh for your reply, that behavior would be great. ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 10, 2015, 5:41pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/8 "2015-06-10T17:41:23Z")
Patrik, please note that this functionality was added in beta 2: [https://www.elastic.co/guide/en/watcher/current/actions.html#anatomy-actions-index-multi-doc-support](https://www.elastic.co/guide/en/watcher/current/actions.html#anatomy-actions-index-multi-doc-support) It's a bit different than what is described above, but still supported - just put whatever array of docs under the `_doc` field in the payload ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/index-action-document-construction/1181/9 "2017-07-06T13:49:36Z")