# Payload: filters and counts result

**URL:** <https://discuss.elastic.co/t/payload-filters-and-counts-result/146763>\
**Category:** Kibana\
**Created:** [August 30, 2018, 6:03pm UTC](https://discuss.elastic.co/t/payload-filters-and-counts-result/146763 "2018-08-30T18:03:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mdavi](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mdavi](https://discuss.elastic.co/u/mdavi)\
**Post date:** [August 30, 2018, 6:03pm UTC](https://discuss.elastic.co/t/payload-filters-and-counts-result/146763/1 "2018-08-30T18:03:49Z")

</div>

Hi everyone,

I'm trying to develop a simple watcher to count the number of the errors and warnings, through reading my application log.  
Everything works well but i'm not able to recognise, which are errors and which are warnings from the payload result.

Could someone help me?  
Thanks in advance.

Matteo

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [August 30, 2018, 6:09pm UTC](https://discuss.elastic.co/t/payload-filters-and-counts-result/146763/2 "2018-08-30T18:09:51Z")

</div>

Hey @mdavi

What does your index mapping look like? If you don't have a dedicated field for log severity, then it might be worthwhile to create one. Both Logstash and Beats can parse log files, and you can teach them how to determine the severity before you send the payload to Elasticsearch. If you're using a common logging format (for example, apache or nginx logs), then you can get that setup with very little effort.

---

<div class="post-metadata">

**Author:** ![mdavi](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mdavi](https://discuss.elastic.co/u/mdavi)\
**Post date:** [August 31, 2018, 6:53am UTC](https://discuss.elastic.co/t/payload-filters-and-counts-result/146763/3 "2018-08-31T06:53:02Z")

</div>

Hi @Larry_Gregory,

thank you for the reply.  
I'm using Logstash and I have a field for log severity.  
Here below you can find a snippet of code in which I define an action email.  
In the body of the email I would like to write the number of Warnings and Errors.  
Is it possible? How?

Thanks in advance.  
Matteo.

"actions": {  
"email\_admin": {  
"email": {  
"stateless": false,  
"to": "emailto@domain.com",  
"from": "emailfrom@domain.com",  
"subject": "Alarm",  
"priority": "high",  
"body": "Found {{payload.hits.total. **WARNINGS** }} Warnings \r\n Found {{payload.hits.total. **ERRORS** }} Errors"  
},  
}  
}

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [August 31, 2018, 11:20am UTC](https://discuss.elastic.co/t/payload-filters-and-counts-result/146763/4 "2018-08-31T11:20:14Z")

</div>

I'd need to see the index mapping and query you are using to give you a definitive answer, but in order to access the payload within the body, you'll likely need to prefix it with `ctx`: `ctx.payload.hits.total ...`

---

<div class="post-metadata">

**Author:** ![mdavi](https://avatars.discourse-cdn.com/v4/letter/m/8e7dd6/32.png) [@mdavi](https://discuss.elastic.co/u/mdavi)\
**Post date:** [September 3, 2018, 4:06pm UTC](https://discuss.elastic.co/t/payload-filters-and-counts-result/146763/5 "2018-09-03T16:06:52Z")

</div>

Hi @Larry_Gregory,

Here below you can find the query.  
In the first part I filter the environment (Test).  
In the second part I create 3 adjacency matrix (one foreach of my application) e I would like to read the number of errors/warnigns/informations contained.  
Is it possibile? How ?

GET /\_search  
{  
"query": {  
"bool": {  
"must": [  
{  
"match": {  
"fields.EnvironmentName": "TEST"  
}  
}  
]  
}  
},  
"aggs" : {  
"interactions" : {  
"adjacency\_matrix" : {  
"filters" : {  
"App1" : {  
"match" : { "fields.ApplicationName": "App1" },  
"aggs" : { "errors" : { "match" : { "level" : "Error" }}, "warnings" : { "match" : { "level" : " Warning" }} }}  
},  
"App2" :  
{  
"match" : { "fields.ApplicationName": "App2",  
"aggs" : { "errors" : { "match" : { "level" : "Error" }}, "warnings" : { "match" : { "level" : " Warning" }} }}  
}},  
"App3" :  
{  
"match" : { "fields.ApplicationName": "App3" }  
"aggs" : { "errors" : { "match" : { "level" : "Error" }}, "warnings" : { "match" : { "level" : " Warning" }} }}  
}   
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2018, 4:06pm UTC](https://discuss.elastic.co/t/payload-filters-and-counts-result/146763/6 "2018-10-01T16:06:56Z")

</div>

Closed on October 1, 2018, 4:06pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.