# Painless Script for Index Action

**URL:** <https://discuss.elastic.co/t/painless-script-for-index-action/87800>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 31, 2017, 7:51pm UTC](https://discuss.elastic.co/t/painless-script-for-index-action/87800 "2017-05-31T19:51:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\
**Post date:** [May 31, 2017, 7:51pm UTC](https://discuss.elastic.co/t/painless-script-for-index-action/87800/1 "2017-05-31T19:51:22Z")

</div>

Hi,

I am trying to create index action and push aggregated result back into elasticsearch much like [this post](https://www.elastic.co/blog/implementing-a-statistical-anomaly-detector-part-3).

Below is the painless script that I wrote for this purpose. Once I run this watch, I am getting all the aggregation result in 1 document instead of getting 1 document for each count or bucket.

Script:

```
   "transform":{
            "script": {
                "lang": "painless",
                "inline": "ctx.payload._doc = []; def myfield = 'abc'; def count = 'abc'; def execution_time = 'abc'; for(item in ctx.payload.aggregations.filter_by_myfield.buckets.entrySet()) { def document = ['myfield' : item.getKey(), 'count' : item.getValue().doc_count, 'execution_time' : ctx.execution_time]; ctx.payload._doc.add(document);} return ctx.payload._doc; "
            }
     }

```

The result is something like this in Kibana (only 1 document):

```
"_source": {
    "_value": [
      {
        "count": 29,
        "myfield": "VALUE_1523",
        "execution_time": "2017-05-31T19:39:38.466Z"
      },
      {
        "count": 52,
        "dnis": "VALUE_1010",
        "execution_time": "2017-05-31T19:39:38.466Z"
      }
    ]
  },

```

I have gone through[this doc](https://www.elastic.co/guide/en/x-pack/current/actions-index.html#anatomy-actions-index-multi-doc-support), where it says if `_doc` is an array, it is split into multiple documents. I did the same, but still `_value` field is getting all the aggregation result in 1 document.

I also tried `_doc` instead of `ctx.payload._doc`, but no success.

---

<div class="post-metadata">

**Author:** ![krishna\_chaitanya](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\
**Post date:** [May 31, 2017, 9:19pm UTC](https://discuss.elastic.co/t/painless-script-for-index-action/87800/2 "2017-05-31T21:19:09Z")

</div>

After couple of trials, I got this to work.

```
"transform":{
            "script": {
                "lang": "painless",
                "inline": "def docs = []; def myfield = ''; def count = ''; def execution_time = ''; for(item in ctx.payload.aggregations.filter_by_myfield.buckets.entrySet()) { def document = ['myfield' : item.getKey(), 'count' : item.getValue().doc_count, 'execution_time' : ctx.execution_time]; docs.add(document);} return ['_doc' : docs]; "
            }
         }

```

I was not returning a map correctly. Fixing the return to this worked: `return ['_doc' : docs]`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2017, 9:19pm UTC](https://discuss.elastic.co/t/painless-script-for-index-action/87800/3 "2017-06-28T21:19:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.