# Multiple bucket filter

**URL:** <https://discuss.elastic.co/t/multiple-bucket-filter/249475>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting, painless\
**Created:** [September 22, 2020, 8:20am UTC](https://discuss.elastic.co/t/multiple-bucket-filter/249475 "2020-09-22T08:20:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\
**Post date:** [September 22, 2020, 8:20am UTC](https://discuss.elastic.co/t/multiple-bucket-filter/249475/1 "2020-09-22T08:20:34Z")

</div>

Hi,  
Is there a way to use multiple conditions in a stream filter?  
I tried :

```auto
transform": {
    "script": {
      "source": """
            def docs = [];
            def removes=ctx.payload.aggregations.event_types.buckets.remove.users.buckets.stream().map(p -> p.key).collect(Collectors.toList());
            def logins=ctx.payload.aggregations.event_types.buckets.login.users.buckets.stream().map(p -> p.key).collect(Collectors.toList());
            def hits = ctx.payload.aggregations.event_types.buckets.add.users.buckets;
            for (hit in hits){
              def document = [
                '@timestamp':ctx.execution_time,
                'origin host': ctx.payload.aggregations.event_types.buckets.add.users.buckets.stream().map(o -> o.host.ip).filter(o -> removes.contains(o)).filter(o -> logins.contains(o)).toArray(), 
                'usernames' : ctx.payload.aggregations.event_types.buckets.add.users.buckets.stream().map(u -> u.key).filter(u -> removes.contains(u)).filter(u -> logins.contains(u)).toArray()
                ];
                docs.add(document);
            }
            return ['_doc':docs];
          """,
      "lang": "painless"
    }

```

But I got :

```auto
 "transform" : {
        "type" : "script",
        "status" : "failure",
        "reason" : "runtime error",
        "error" : {
          "root_cause" : [
            {
              "type" : "script_exception",
              "reason" : "runtime error",
              "script_stack" : [
                "o -> o.host.ip).filter(",
                " ^---- HERE"
              ],

```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 22, 2020, 8:49am UTC](https://discuss.elastic.co/t/multiple-bucket-filter/249475/2 "2020-09-22T08:49:27Z")

</div>

please share the full exception and also the search response, otherwise it is hard to debug further.

---

<div class="post-metadata">

**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\
**Post date:** [September 22, 2020, 9:02am UTC](https://discuss.elastic.co/t/multiple-bucket-filter/249475/3 "2020-09-22T09:02:28Z")

</div>

Hi Alex,  
[Here](https://gist.github.com/bornatalebi/92f004ff2faf84647418438d72b06261) are my watcher config and full exception. If you need any additional information let me know.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 23, 2020, 12:22pm UTC](https://discuss.elastic.co/t/multiple-bucket-filter/249475/4 "2020-09-23T12:22:18Z")

</div>

Your script states

```auto
ctx.payload.aggregations.event_types.buckets.add.users.buckets.stream().map(o -> o.host.ip)

```

however the payload (the search response) does not contain any host/ip field? Where should this come from?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2020, 12:22pm UTC](https://discuss.elastic.co/t/multiple-bucket-filter/249475/5 "2020-10-21T12:22:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.