# Multi Document Index in not working with 6.1.3

**URL:** <https://discuss.elastic.co/t/multi-document-index-in-not-working-with-6-1-3/135373>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 11, 2018, 2:01pm UTC](https://discuss.elastic.co/t/multi-document-index-in-not-working-with-6-1-3/135373 "2018-06-11T14:01:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sgarap](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@sgarap](https://discuss.elastic.co/u/sgarap)\
**Post date:** [June 11, 2018, 2:01pm UTC](https://discuss.elastic.co/t/multi-document-index-in-not-working-with-6-1-3/135373/1 "2018-06-11T14:01:12Z")

</div>

Hi,

We have a test Elastic Cloud Enterprise on AWS. I followed blog [https://www.elastic.co/blog/understanding-your-teams-usage-with-elastic-cloud-enterprise](https://www.elastic.co/blog/understanding-your-teams-usage-with-elastic-cloud-enterprise) and created a dedicated cluster for watcher for collecting cluster information. The elasticsearch cluster I created is of version 6.1.3. Then I wanted to create a watch to collect cluster information from Elastic Cloud Enterprise API (Also mentioned in the blog above). My watch looks like

curl -k -u elastic:removedintentionally -X PUT "[https://86fb30ea0abe4b779255e639c8c50c11.ipremovedintentionally.ip.es.io:9243/\_xpack/watcher/watch/clusters\_transform](https://86fb30ea0abe4b779255e639c8c50c11.ipremovedintentionally.ip.es.io:9243/_xpack/watcher/watch/clusters_transform)" -H 'Content-Type: application/json' -d'  
{  
"trigger": {  
"schedule": {  
"interval": "10m"  
}  
},  
"input": {  
"http": {  
"request": {  
"scheme": "http",  
"host": "Cloud UI LoadBalancer IP Removed Intentionally",  
"port": 80,  
"method": "get",  
"path": "/api/v1/clusters/elasticsearch",  
"params": {},  
"headers": {},  
"auth": {  
"basic": {  
"username": "readonly",  
"password": "removedintentionally"  
}  
}  
}  
}  
},  
"condition": {  
"always": {}  
},  
"actions": {  
"index\_payload": {  
"transform": {  
"script": {  
"source": "return ['\_doc' : ctx.payload.elasticsearch\_clusters]",  
"lang": "painless"  
}  
},  
"index": {  
"index": "ece-running-clusters",  
"doc\_type": "ece-running-cluster",  
"execution\_time\_field": "timestamp"  
}  
}  
}  
}  
'  
The error I receive while creating the watch is

{  
"error": {  
"root\_cause": [{  
"type": "script\_exception",  
"reason": "compile error",  
"script\_stack": ["return [\_doc : ctx.payload.elasti ...", " ^---- HERE"],  
"script": "return [\_doc : ctx.payload.elasticsearch\_clusters]",  
"lang": "painless"  
}  
],  
"type": "script\_exception",  
"reason": "compile error",  
"script\_stack": ["return [\_doc : ctx.payload.elasti ...", " ^---- HERE"],  
"script": "return [\_doc : ctx.payload.elasticsearch\_clusters]",  
"lang": "painless",  
"caused\_by": {  
"type": "illegal\_argument\_exception",  
"reason": "Variable [\_doc] is not defined."  
}  
},  
"status": 500  
}

The Clusters info is properly returned by curl -k -X GET -u readonly:removed removed:80/api/v1/clusters/elasticsearch. I also tried by removing the quotes surrounding \_doc in transform section. It didn't help. Can someone point me to what is wrong here?

Regards,  
Sindhura

---

<div class="post-metadata">

**Author:** ![baz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baz/32/5183_2.png) [@baz](https://discuss.elastic.co/u/baz)\
**Post date:** [June 21, 2018, 4:57pm UTC](https://discuss.elastic.co/t/multi-document-index-in-not-working-with-6-1-3/135373/2 "2018-06-21T16:57:42Z")

</div>

Hi, I havent looked at this much yet, but let me first ask if you are escaping the single quotes in the painless script. It looks like you are doing single quotes around the whole json body so u dont have to escape all the double quotes, but since there are single quotes in there, maybe its misinterpreting it via the cli? try \'\_doc\' and then if that fails i will attempt to execute this watch on a test cluster of my own.

Thanks,  
Baz.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 22, 2018, 1:55pm UTC](https://discuss.elastic.co/t/multi-document-index-in-not-working-with-6-1-3/135373/3 "2018-06-22T13:55:39Z")

</div>

Hey,

have you tried `return ['_doc' : ...]` (in quotes) and see if that works? Otherwise painless tries to interpret `_doc` as a variable instead of as a quoted string.

--Alex

---

<div class="post-metadata">

**Author:** ![sgarap](https://avatars.discourse-cdn.com/v4/letter/s/3ec8ea/32.png) [@sgarap](https://discuss.elastic.co/u/sgarap)\
**Post date:** [June 26, 2018, 1:55pm UTC](https://discuss.elastic.co/t/multi-document-index-in-not-working-with-6-1-3/135373/4 "2018-06-26T13:55:37Z")

</div>

Hi Baz,

Thanks for your Reply. Using double quotes and escaping them worked `(\"_doc\").` Escaping single quotes didn't work.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2018, 2:02pm UTC](https://discuss.elastic.co/t/multi-document-index-in-not-working-with-6-1-3/135373/5 "2018-07-24T14:02:27Z")

</div>

Closed on July 24, 2018, 2:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.