# Iterates bucket aggs in second chain input
**URL:** https://discuss.elastic.co/t/iterates-bucket-aggs-in-second-chain-input/90017
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [June 20, 2017, 2:32am UTC](https://discuss.elastic.co/t/iterates-bucket-aggs-in-second-chain-input/90017 "2017-06-20T02:32:02Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@abpabab](https://discuss.elastic.co/u/abpabab)
#### Post date: [June 20, 2017, 2:32am UTC](https://discuss.elastic.co/t/iterates-bucket-aggs-in-second-chain-input/90017/1 "2017-06-20T02:32:02Z")
In chain seach, I use my first aggs result as the input for second chain. Follow the example [here](https://raw.githubusercontent.com/elastic/examples/master/Alerting/new_process_started/watch.json):
`"terms": { "process_host": ["{{#ctx.payload.started_processes.aggregations.process_hosts.buckets}}{{key}}", "{{/ctx.payload.started_processes.aggregations.process_hosts.buckets}}"] }`
this snippet always return the empty element at the end, this is the result:
`"reason": "SearchPhaseExecutionException[all shards failed]; nested: QueryShardException[failed to create query: {\n \"bool\" : {\n \"must\" : [\n {\n \"terms\" : {\n \"src_ip\" : [\n \"172.16.36.32\",\n \"172.16.36.33\",\n \"172.16.36.64\",\n \"\"\n],\n \"boost\" : 1.0\n }\n },\n {\n \"term\" : {\n \"switch_error\" : {\n \"value\" : \"%SEC_LOGIN-4-LOGIN_FAILED\",\n \"boost\" : 1.0\n }\n }\n }\n ],\n \"disable_coord\" : false,\n \"adjust_pure_negative\" : true,\n \"boost\" : 1.0\n }\n}]; nested: IllegalArgumentException['' is not an IP string literal.]; ",`
my `src_ip` aggs returns 3 IPs. How to make it right?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2017, 2:32am UTC](https://discuss.elastic.co/t/iterates-bucket-aggs-in-second-chain-input/90017/2 "2017-07-18T02:32:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.