Mathematical operations on individual bucket elemenst

My goal is to set up an alert which is only triggered if one of the term's count is at least the 10% of the other one. In my final aggregation (third), I get two key and doc counts to compare.
For example, in the query, I'm looking for all non-US visitors, but it's only interesting to me if the none-US/US doc count rate is above 10 percent.

Hey,

you can setup the alert condition to check if the values of your two buckets differ by more than 10 percent.

The examples repo might help a bit.

--Alex

I've to check that if ctx.payload.secondinchain.aggregations.first.buckets.second.buckets.third.buckets.0.doc_count divided with the same buckets other doc count (if present) ctx.payload.secondinchain.aggregations.first.buckets.second.buckets.third.buckets.1.doc_count
is over 0.1 .
But I get various syntax errors by using that method.
Also, I want to filter out the results in the same bucket.
//filter out this one:
... "buckets": [
{
"doc_count": 13,
"key": "NON-US"
},
{
"doc_count": 2238,
"key": "US"
}
]
},
"key": "registration"
}
...
//keep this one
... "buckets": [
{
"doc_count": 130,
"key": "NON-US"
},
{
"doc_count": 600,
"key": "US"
}
]
},
"key": "discounts"
}
...
Could you please point me into the direction where I can check how to refer to those values correctly?

where is the script you tested with? Can you provide the full watch?

This is how the current watch looks:

``````  {
"trigger" : { "schedule" : { "interval" : "1m"  } },
"input" : {
"chain" : {
"inputs" : [
{
"firstchain" : {
"search" : {
"request" : {
"indices" : [ "<index-{now/d}>","<index-{now}>" ],
"types" : [ "type1" ],
"body" : {
"size" : 1,
"query" : {
"bool": {
"must": [ 	{ "match_phrase": {  "country": "US"  } },
{ "range" : { "@timestamp" : { "from" : "now-1h" }}}
]
}
},
"aggs": {
"countries": {
"terms": { "field": "country.keyword",

"order": {  "_count": "desc"  }
},
"aggs": {
"pages" : {
"terms": {
"field": "page.keyword",
"min_doc_count": 10,
"order": {
"_term": "desc"
}
}
}
}
}
}
}
}
}
}
},
{
"secondchain" : {
"search" : {
"request" : {
"indices" : [ "<index-{now/d}>","<index-{now}>" ],
"types" : [ "type1" ],
"body" : {
"size" : 1,
"query" : {
"bool": {
"must": 	{ "range" : { "@timestamp" : { "from" : "now-1h" }}},
"should": { "terms": {
"page.keyword": [
]
}},
"minimum_should_match" : "1",
"filter": { "terms": {
"country.keyword": ["US","non-US"]
}}
}
},
"aggs": {
"sites": {
"terms": {
"field": "site.keyword",
"order": {
"_count": "desc"
}
},
"aggs": {
"pages": {
"terms": {
"field": "page.keyword",
"order": {
"_count": "desc"
}
},
"aggs": {
"countries" : {
"terms": {
"field": "country.keyword",
"order": {
"_term": "desc"
}
}
}
}
}
}
}
}
}
}
}
}
}
]
}
},
"condition" : {
{
}
},
"actions" :{
"send_email" : {
"throttle_period": "4m",
"email" : {
"to" : "to@me.com",
"subject" : "-",
"body" : { "html": ""
}
}
}
}
}``````

Hey,

this is pretty lengthy. In order to debug I also need the output of the execute watch API or the latest watch history entry (of course only when there is a problem executing, not the good case).

--Alex

Hello!

``````"exception": {
"type": "script_exception",
"reason": "runtime error",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Illegal list shortcut value [pages].",
},
"script_stack": [
"                                                                  ^---- HERE"
],
"lang": "painless",