# Multiple Aggregations, index\_out\_of\_bounds\_exception error

**URL:** <https://discuss.elastic.co/t/multiple-aggregations-index-out-of-bounds-exception-error/83565>\
**Category:** Elasticsearch\
**Created:** [April 25, 2017, 12:17pm UTC](https://discuss.elastic.co/t/multiple-aggregations-index-out-of-bounds-exception-error/83565 "2017-04-25T12:17:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vovo](https://avatars.discourse-cdn.com/v4/letter/v/a4c791/32.png) [@vovo](https://discuss.elastic.co/u/vovo)\
**Post date:** [April 25, 2017, 12:17pm UTC](https://discuss.elastic.co/t/multiple-aggregations-index-out-of-bounds-exception-error/83565/1 "2017-04-25T12:17:08Z")

</div>

Hi, I'm trying to develop an elastic search watcher that includes multiple aggregations. I want to group the documents based on the accounts and for each account check if a series of consecutive "failure" attempts in 15 min interval has occurred and also if that is followed by a single or more "success" attempts.

I think the way to do this is using multiple aggregations. Please let me know your thoughts if you are aware of a solution! I am confused as I am new to Elasticsearch.

**I receive this error:**

```
"messages": [
  "failed to execute watch input"

```

**and this is the explanation**  
{  
"error": {  
"root\_cause": [  
{  
"type": "parsing\_exception",  
"reason": "request does not support [trigger]",  
"line": 2,  
"col": 3  
}  
],  
"type": "parsing\_exception",  
"reason": "request does not support [trigger]",  
"line": 2,  
"col": 3  
},  
"status": 400  
}

**This is my code:**

{  
"trigger": {  
"schedule": {  
"interval": "50m"  
}  
},  
"input": {  
"search": {  
"request": {  
"indices": "",  
"body": {  
"query": {  
"wildcard": {  
"account\_name.keyword": ""  
}  
},  
"aggregations": {  
"accounts": {  
"terms": {  
"field": "accountname.keyword"  
}  
},  
"aggregations": {  
"failure": {  
"terms": {  
"field": "FAILURE",  
"size": 2  
}  
},  
"by\_hour": {  
"date\_histogram": {  
"field": "date",  
"interval": "15m"  
},  
"aggregations": {  
"success": {  
"terms": {  
"field": "SUCCESS"  
}  
}  
}  
}}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.aggregations.accounts.buckets.0.doc\_count": {  
"gt": 2  
}  
}  
},  
"actions": {  
"send\_email": {  
"email": {  
"to": "",  
"subject": "",  
"body": "",  
"attachments": {  
"attached\_data": {  
"data": {  
"format": "json"  
}  
}  
},  
"priority": "high"  
}  
}  
}  
}

Thank you

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [April 25, 2017, 12:29pm UTC](https://discuss.elastic.co/t/multiple-aggregations-index-out-of-bounds-exception-error/83565/2 "2017-04-25T12:29:37Z")

</div>

Hi @vovo,

As this is a Watcher question, I have moved it to the "X-Pack" forum category.

Cheers,

Shaunak

---

<div class="post-metadata">

**Author:** ![vovo](https://avatars.discourse-cdn.com/v4/letter/v/a4c791/32.png) [@vovo](https://discuss.elastic.co/u/vovo)\
**Post date:** [April 25, 2017, 3:34pm UTC](https://discuss.elastic.co/t/multiple-aggregations-index-out-of-bounds-exception-error/83565/3 "2017-04-25T15:34:20Z")

</div>

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:39pm UTC](https://discuss.elastic.co/t/multiple-aggregations-index-out-of-bounds-exception-error/83565/4 "2017-07-06T13:39:58Z")

</div>