# Not able to output two or multiple aggregations in a loop
**URL:** https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [May 29, 2018, 2:17pm UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693 "2018-05-29T14:17:44Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [May 29, 2018, 2:17pm UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/1 "2018-05-29T14:17:44Z")
Hi all,
i am able to print values in loop but i am stuck in one condition, i have a chain query where i am able to print values from first chain using its aggregations but "I am not able to print values from Second chain and its aggregations in HTML Table"
due to word limit .. Here is the first query: and second query is in my next Reply to this post...
```
{
"trigger": {
"schedule": {
"interval": "10s"
}
},
"input": {
"chain": {
"inputs": [
{
"first": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-checkpoint-*"
],
"types": [],
"body": {
"aggs": {
"time": {
"terms": {
"field": "@timestamp",
"size": 50,
"order": {
"_count": "desc"
}
},
"aggs": {
"srcip": {
"terms": {
"field": "srcip.keyword",
"size": 50,
"order": {
"_count": "desc"
}
},
"aggs": {
"dstip": {
"terms": {
"field": "dstip.keyword",
"size": 50,
"order": {
"_count": "desc"
}
}
}
}
}
}
}
},
"version": true,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
"@timestamp"
],
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"match_all": {}
},
{
"exists": {
"field": "srcip.keyword"
}
},
{
"exists": {
"field": "dstip.keyword"
}
},
{
"bool": {
"should": [
{
"match_phrase": {
"threaintel_IP.keyword": "true"
}
}
],
"minimum_should_match": 1
}
},
{
"range": {
"@timestamp": {
"gte": "now-1d"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
}
}
}
},
```
---
### Author:  [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [May 30, 2018, 12:40am UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/2 "2018-05-30T00:40:54Z")
Anuj,
Can you please post the full output of your watch execution in Console (the entire JSON of the right hand panel)? You can redact any sensitive information.
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 26, 2018, 11:17am UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/3 "2018-06-26T11:17:40Z")
Second Query and HTML table where i am facing issue----
```
{
"second": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logstash-security-*"
],
"types": [],
"body": {
"aggs": {
"feed": {
"terms": {
"field": "feed_name.keyword",
"size": 50,
"order": {
"_count": "desc"
}
},
"aggs": {
"type": {
"terms": {
"field": "indicatortype.keyword",
"size": 50,
"order": {
"_count": "desc"
}
}
}
}
}
},
"version": true,
"_source": {
"excludes": []
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
"@timestamp",
"security_log.time"
],
"query": {
"bool": {
"must": [
{
"match_all": {}
},
{
"match_all": {}
},
{
"match_phrase": {
"type.keyword": {
"query": "threatintel"
}
}
},
{
"exists": {
"field": "feed_name.keyword"
}
},
{
"exists": {
"field": "indicatortype.keyword"
}
},
{
"query_string": {
"query": "indicator:{{#ctx.payload.first.aggregations.time.buckets.0.srcip.buckets.0.dstip.buckets}}{{key}} {{/ctx.payload.first.aggregations.time.buckets.0.srcip.buckets.0.dstip.buckets}}"
}
},
{
"range": {
"@timestamp": {
"gte": "now-7d"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
}
}
}
}
}
}
]
}
},
"condition": {
"compare": {
"ctx.payload.second.hits.total": {
"gt": 0
}
}
},
"actions": {
"log": {
"logging": {
"level": "info",
"text": "Test"
}
},
"send_mail": {
"email": {
"profile": "standard",
"to": [
"addanuj@gmail.com"
],
"subject": "Test 2 Threat Intel",
"body": {
"html": "| Timestamp | Source IP | Indicator IP | Feed Name | Count |
|---|
{{#ctx.payload.first.aggregations.time.buckets}}| {{key_as_string}} | {{srcip.buckets.0.key}} | {{srcip.buckets.0.dstip.buckets.0.key}} | {{#ctx.payload.second.aggregations.feed.buckets}}{{key}}{{/ctx.payload.second.aggregations.feed.buckets}} | {{doc_count}} |
{{/ctx.payload.aggregations.time.buckets}}
"
}
}
}
}
}
```
please help me to correct it.
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 26, 2018, 11:22am UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/4 "2018-06-26T11:22:47Z")
Hi Rich,
due to word limit in a post i have posted this thread again, please help.
---
### Author:  [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [June 26, 2018, 2:48pm UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/5 "2018-06-26T14:48:01Z")
> [@addanuj](#):
>
> ```auto
> "query_string": { "query": "indicator:{{#ctx.payload.first.aggregations.time.buckets.0.srcip.buckets.0.dstip.buckets}}{{key}} {{/ctx.payload.first.aggregations.time.buckets.0.srcip.buckets.0.dstip.buckets}}" } },
>
> ```
I'm not 100% sure that a mustache syntax "loop" will work in the `query_string` like this.
@spinscale - do you know?
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 27, 2018, 7:08am UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/6 "2018-06-27T07:08:30Z")
The better and more flexible way would be to use a transform between the two chained inputs, to create the search string you need in a script. See [https://www.elastic.co/guide/en/elastic-stack-overview/6.3/input-chain.html#\_transforming\_chained\_input\_data](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/input-chain.html#_transforming_chained_input_data)
---
### Author:  [@addanuj](https://discuss.elastic.co/u/addanuj)
#### Post date: [June 27, 2018, 8:32am UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/7 "2018-06-27T08:32:16Z")
loop is working perfectly for me... i am not able to solve the below part...
```
"body": {
"html": "| Timestamp | Source IP | Indicator IP | Feed Name | Count |
|---|
{{#ctx.payload.first.aggregations.time.buckets}}| {{key_as_string}} | {{srcip.buckets.0.key}} | {{srcip.buckets.0.dstip.buckets.0.key}} | {{#ctx.payload.second.aggregations.feed.buckets}}{{key}}{{/ctx.payload.second.aggregations.feed.buckets}} | {{doc_count}} |
{{/ctx.payload.aggregations.time.buckets}}
"
}
```
it should four fields in following format: time - srcip - dstip - feed - count
here feed is from second query aggregation and from second loop.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 27, 2018, 11:49am UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/8 "2018-06-27T11:49:43Z")
can you include a sample search response here as well, that you are trying to parse?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 25, 2018, 11:56am UTC](https://discuss.elastic.co/t/not-able-to-output-two-or-multiple-aggregations-in-a-loop/133693/9 "2018-07-25T11:56:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.