# Question about the index action in a watch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [March 26, 2019, 8:51am UTC](https://discuss.elastic.co/t/question-about-the-index-action-in-a-watch/173886 "2019-03-26T08:51:40Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Post date:** [March 26, 2019, 8:51am UTC](https://discuss.elastic.co/t/question-about-the-index-action-in-a-watch/173886/1 "2019-03-26T08:51:40Z")
Hi, I want to monitor when the number of filebeat agents changes. I prefer that instead of a log action or a mail action that it is indexed to the nagios index. I have a script that reads out the nagios index and then magic operation stuff happens. Now I want to add some fields when the index action is executed fields: "nagios\_color" : "yellow" "nagios\_msg" : "The number of filebeat agents is {{ctx.payload.aggregations.type\_count.value}}" I think this is done by the transform block but I haven't gotten it working yet. Any one has an idea since the examples in the documentation are not very clear on how you do this. do I just add ``` "transform" : { "script": "return [nagios_color: yellow]" } ``` my watch: ``` { "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ ".monitoring-beats-6-*" ], "types": [], "body": { "size": 0, "aggs": { "type_count": { "cardinality": { "field": "beats_stats.beat.name" } } } } } } }, "condition": { "compare": { "ctx.payload.aggregations.type_count.value": { "not_eq": 28 } } }, "actions": { "log": { "logging": { "level": "warn", "text": "The number of filebeat agents is {{ctx.payload.aggregations.type_count.value}}" } }, "index_payload": { "index": { "index": "", "doc_type": "_doc", "execution_time_field": "trigger_event.triggered_time" } } } } ``` ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [March 26, 2019, 12:37pm UTC](https://discuss.elastic.co/t/question-about-the-index-action-in-a-watch/173886/2 "2019-03-26T12:37:55Z")
a transform always replaces the **full** payload. Which means, you need to include the original `ctx.payload` in the map that the transform returns, if you want to access it. With the above example, you are basically only indexing a document consisting of the nagios color field. ---
**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Post date:** [March 26, 2019, 2:48pm UTC](https://discuss.elastic.co/t/question-about-the-index-action-in-a-watch/173886/3 "2019-03-26T14:48:12Z")
> [@MalfuncEddie](#): > > "transform" : { "script": "return [nagios\_color: yellow]" } Hi, if only this was the case. For some reason I only get trigger\_event.triggered\_time. Whatever i put in the transform section. Here is the relevant output of the execute action of the watch. ``` "actions": [ { "id": "index_payload", "type": "index", "status": "success", "transform": { "type": "script", "status": "success", "payload": { "nagios.color": "yellow", "nagios.msg": "msg", "trigger_event.triggered_time": "2019-03-26T14:42:24.766Z" } }, "index": { "response": { "created": true, "result": "created", "id": "rQhzumkBZfOsZFAlyz-H", "version": 1, "type": "_doc", "index": "nagios-2019.03.01" } } } ] ``` result in nagios index ``` { "_index": "nagios-2019.03.01", "_type": "_doc", "_id": "rQhzumkBZfOsZFAlyz-H", "_version": 1, "_score": null, "fields": { "trigger_event.triggered_time": [ "2019-03-26T14:42:24.766Z" ] }, "sort": [ 1553611344766 ] } ``` ---
**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Post date:** [March 29, 2019, 8:27am UTC](https://discuss.elastic.co/t/question-about-the-index-action-in-a-watch/173886/5 "2019-03-29T08:27:32Z")
Hi, I am aware that this would result in document only consisting of nagios.color. Next step is to add more relevant fields. But the problem is that nagios.color is not in the nagios index. Clearly i am doing something wrong and this problem has been troubling me for days. Can you confirm that when this watch executes it should result in a document that (only) contains nagios.color in the nagios index? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 1, 2019, 7:47am UTC](https://discuss.elastic.co/t/question-about-the-index-action-in-a-watch/173886/6 "2019-04-01T07:47:36Z")
Can you show the output of ```auto GET nagios-2019.03.01/_doc/rQhzumkBZfOsZFAlyz-H ``` thanks ---
**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Post date:** [April 15, 2019, 2:18pm UTC](https://discuss.elastic.co/t/question-about-the-index-action-in-a-watch/173886/7 "2019-04-15T14:18:16Z")
Hi, It seemed that a faulty template was causing the issue. After removing the template it works! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 13, 2019, 2:29pm UTC](https://discuss.elastic.co/t/question-about-the-index-action-in-a-watch/173886/8 "2019-05-13T14:29:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.