# Parse the values from aggregation results in watcher transform painless script

**URL:** <https://discuss.elastic.co/t/parse-the-values-from-aggregation-results-in-watcher-transform-painless-script/340485>\
**Category:** Elasticsearch\
**Tags:** painless, transforms\
**Created:** [August 9, 2023, 5:51pm UTC](https://discuss.elastic.co/t/parse-the-values-from-aggregation-results-in-watcher-transform-painless-script/340485 "2023-08-09T17:51:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pavani\_Reddy](https://avatars.discourse-cdn.com/v4/letter/p/5f9b8f/32.png) [@Pavani\_Reddy](https://discuss.elastic.co/u/Pavani_Reddy)\
**Post date:** [August 9, 2023, 5:51pm UTC](https://discuss.elastic.co/t/parse-the-values-from-aggregation-results-in-watcher-transform-painless-script/340485/1 "2023-08-09T17:51:14Z")

</div>

Hello @Badger , @magnusbaeck

Please help on painless script for parsing the timestamp and compare with now-1h.  
'''  
"aggs": {  
"by\_index": {  
"terms": {  
"field": "\_index"  
},  
"aggs": {  
"by\_timestamp": {  
"max": {  
"field": "@timestamp"  
}  
}  
}  
}  
}  
'''  
I have the aggregated result as below  
'''  
"aggregations" : {  
"by\_index" : {  
"doc\_count\_error\_upper\_bound" : 0,  
"sum\_other\_doc\_count" : 607,  
"buckets" : [  
{  
"key" : "watcher-alert-index1-2023.08.08",  
"doc\_count" : 832,  
"by\_timestamp" : {  
"value" : 1.691515913592E12,  
"value\_as\_string" : "2023-08-08T17:31:53.592Z"  
}  
},  
{  
"key" : "watcher-alert-index1-2023.08.07",  
"doc\_count" : 623,  
"by\_timestamp" : {  
"value" : 1.691423470253E12,  
"value\_as\_string" : "2023-08-07T15:51:10.253Z"  
}  
]  
}  
}  
'''  
I want to parse the timestamp from the above using painless script from the above result and compare with now-1h in watcher snippet.

I am new to painless script.

Please help me on this and guide me.

Thanks in advance,  
Pavani

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2023, 5:51pm UTC](https://discuss.elastic.co/t/parse-the-values-from-aggregation-results-in-watcher-transform-painless-script/340485/2 "2023-09-06T17:51:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.