# Multiple Condition using ctx.execution\_time

**URL:** <https://discuss.elastic.co/t/multiple-condition-using-ctx-execution-time/138762>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [July 5, 2018, 3:20pm UTC](https://discuss.elastic.co/t/multiple-condition-using-ctx-execution-time/138762 "2018-07-05T15:20:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![arkandel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arkandel/32/33020_2.png) [@arkandel](https://discuss.elastic.co/u/arkandel)\
**Post date:** [July 5, 2018, 3:20pm UTC](https://discuss.elastic.co/t/multiple-condition-using-ctx-execution-time/138762/1 "2018-07-05T15:20:13Z")

</div>

Hey there,

I am currently polling an endpoint over https for the cluster's health status, and I would like an alert sent if the returned status is a certain value _and_ if it's not between certain times in the day (when our logs rotate, which causes a yellow status).

At first I tried this:

> "condition": {  
> "compare": {  
> "ctx.payload.status": {  
> "eq": "yellow"  
> },  
> "ctx.execution\_time": {  
> "gte": "\<{now/d+5m}\>"  
> }  
> }  
> },

However, although there was no error, the first condition isn't saved - if I reopen my Watcher the first one is gone.

I tried to rewrite it as a script, but that created a second issue:

> "condition": {  
> "script": {  
> "source" : "return ( ctx.payload.status == params.color && ctx.execution\_time \> params.after)",  
> "params" : {  
> "color" : "yellow",  
> "after" : "now/d+5m"  
> }  
> }  
> },

I'm not sure how/whether I should be converting ctx.execution\_time (what's an easy way to tell if it's a string or date type within a script?) and any parameters I pass seem to be treated as strings.

What's the best way to do this? Thanks in advance!

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 6, 2018, 7:57am UTC](https://discuss.elastic.co/t/multiple-condition-using-ctx-execution-time/138762/2 "2018-07-06T07:57:37Z")

</div>

Hey,

thanks for reporting. We should indeed return a proper error message, when you specify more than one field. If you `GET` the watch, the first condition will be gone. I opened [#31852](https://github.com/elastic/elasticsearch/issues/31852) to fix this in the future.

Using a `script` condition is indeed the way to go here. However you cannot use date math in there, this only works when specifying indices or inside of queries, but not when doing scripting. Instead you need to do something like this

```auto
POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "10h"
      }
    },
    "input": {
      "none": {}
    },
    "actions": {
      "logme": {
        "transform": {
          "script": "return Instant.ofEpochMilli(ctx.execution_time.getMillis()).plus(5, ChronoUnit.DAYS).truncatedTo(ChronoUnit.DAYS).toString();"
        },
        "logging": {
          "text": "{{ctx.payload}}"
        }
      }
    }
  }
}

```

This might not be exactly what you want, but I hope it gets you a first impression how to change the data.

Hope this helps!

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2018, 7:57am UTC](https://discuss.elastic.co/t/multiple-condition-using-ctx-execution-time/138762/3 "2018-08-03T07:57:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.