# Return ouput instead of using a hard true or false | Watcher

**URL:** https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [August 20, 2019, 1:21pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942 "2019-08-20T13:21:46Z")
**Posts on this page:** 14
**Page:** 1

<div class="post-metadata">

### Author: ![ntran](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@ntran](https://discuss.elastic.co/u/ntran)
#### Post date: [August 20, 2019, 1:21pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/1 "2019-08-20T13:21:46Z")

</div>

Hi all,

Is there a way I can return my new array "list" instead of hard coding true?  
I know they both will come to the same outcome, however, I'm trying my best to not hard code anything which isn't necessary

// Watcher condition thus far

> <https://gist.github.com/nhtrn/0b168f4ebeec7477533ba2be87a2fb2b>

Thank you 🙂

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 20, 2019, 1:47pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/2 "2019-08-20T13:47:01Z")

</div>

hey,

slight workaround: you can just set a variable in the payload like `ctx.payload.foo = new_list` and then return true or false for the condition to match.

--Alex

---

<div class="post-metadata">

### Author: ![ntran](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@ntran](https://discuss.elastic.co/u/ntran)
#### Post date: [August 20, 2019, 1:57pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/3 "2019-08-20T13:57:38Z")

</div>

Hi @spinscale  
Can you please show me with an example?  
I still don't completely understand this

Thanks,  
Nhung

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 20, 2019, 1:59pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/4 "2019-08-20T13:59:26Z")

</div>

```auto
"condition": {
    "script": {
      "source": "ctx.payload.foo = 'bar' ; return true"
   }
}

```

---

<div class="post-metadata">

### Author: ![ntran](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@ntran](https://discuss.elastic.co/u/ntran)
#### Post date: [August 20, 2019, 2:07pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/5 "2019-08-20T14:07:20Z")

</div>

Hi @spinscale

I have that already - it's just truncated in my gist on github.  
`ctx.payload.array_new = list; return true;`

My question was more if I could just return "list" instead of "true". I don't think my code currently does that, however I believe you can and was hoping for advice on how I can achieve this.

I found this example online for reference from [A Brief Painless Walkthrough](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-walkthrough.html#_updating_fields_with_painless)

 ![49%20pm](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb24c71557568e6270634da7be32c9762afd5259.png)

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 20, 2019, 2:09pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/6 "2019-08-20T14:09:04Z")

</div>

then I do not understand your question. A condition **requires** a boolean to be returned in order to trigger the actions or not, and you can access the newly created data structure in your actions.

The above example is something completely different than a watcher condition and therefore returns something completely different - that is relevant in that context.

What else is needed here?

---

<div class="post-metadata">

### Author: ![ntran](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@ntran](https://discuss.elastic.co/u/ntran)
#### Post date: [August 20, 2019, 2:18pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/7 "2019-08-20T14:18:41Z")

</div>

Sorry about that

Question: Is there anyway I can access the list without a `ctx.payload`?

Thank you,  
Nhung

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 20, 2019, 2:20pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/8 "2019-08-20T14:20:16Z")

</div>

you need to store it somewhere that it can be passed around the execution, and that place is the payload or `ctx.vars` in the so called watch execution context.

Again, what is the use-case, that cannot be covered at the moment? If I understand this, I may be able to help further instead of asking around 🙂

---

<div class="post-metadata">

### Author: ![ntran](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@ntran](https://discuss.elastic.co/u/ntran)
#### Post date: [August 20, 2019, 2:31pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/9 "2019-08-20T14:31:06Z")

</div>

Use-case: Create an alert to notify me of which customer has not received anything. If `doc_count` is 0, this means nothing has been sent to the client. The `action` should call upon the client name.

// Console + Output thus far:

> <https://gist.github.com/nhtrn/7e03676f1d08c94be04cd40261268d3f>

I feel like I am missing something in my condition, however I don't know what. When I play around in the "action", by doing `{{ctx.payload.array_new}}`, for example, I always get error messages. I have put in a simple text action for the time being.

Thanks for always helping by the way! I really appreciate it

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 21, 2019, 7:46am UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/10 "2019-08-21T07:46:01Z")

</div>

can you include `{{ctx.payload}}` in the logging output instead of a non templated text and rerun? This way you can see if that array is part of your payload.

---

<div class="post-metadata">

### Author: ![ntran](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@ntran](https://discuss.elastic.co/u/ntran)
#### Post date: [August 21, 2019, 9:05am UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/11 "2019-08-21T09:05:25Z")

</div>

```
PUT _watcher/watch/testing
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": "edmetricdata*",
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "range": {
                    "metricdate": {
                      "gte": "now-1h"
                    }
                  }
                },
                {
                  "exists": {
                    "field": "managedobjectref.keyword"
                  }
                }
              ]
            }
          },
          "aggs": {
            "managedobjectref": {
              "terms": {
                "field": "managedobjectref.keyword"
              },
              "aggs": {
                "timerange": {
                  "range": {
                    "field": "metricdate",
                    "ranges": [
                      {
                        "from": "now-30m"
                      }
                    ]
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": """
def list = []; 
for (int j=0;j<ctx.payload.aggregations.managedobjectref.buckets.size();j++){
  
 if(ctx.payload.aggregations.managedobjectref.buckets[j].timerange.buckets[0].doc_count == 0){
list.add(ctx.payload.aggregations.managedobjectref.buckets[j]);
}
}
ctx.payload.array_new = list;

return ctx.payload.array_new.size() == 0;
"""
    }
  },
  "actions": {
    "log": {
      "logging": {
        "text": "{{ctx.payload.array_new}}"
      }
    }
  }
}

```

// Executed output

> <https://gist.github.com/nhtrn/60d887b3be2e1239606a7ba2e0481eeb>

Thanks in advanced 🙂

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [August 21, 2019, 9:10am UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/12 "2019-08-21T09:10:38Z")

</div>

I asked for `{{ctx.payload}}` as this would allow us if there is an empty object.

For debugging, please remove the `if` statement and just write something into that array. Just try `def list = [1,2,3,4] ; ctx.payload.array_new = list`

Also your condition logic is flawed. You return true, if the list is empty and then have an empty list in your logging statement

---

<div class="post-metadata">

### Author: ![ntran](https://avatars.discourse-cdn.com/v4/letter/n/73ab20/32.png) [@ntran](https://discuss.elastic.co/u/ntran)
#### Post date: [August 21, 2019, 1:42pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/13 "2019-08-21T13:42:23Z")

</div>

Got the solution I was looking for

// For future people reading this:

```
  "condition": {
    "script": {
      "source": """
def list = []; 
for (int j=0;j<ctx.payload.aggregations.forward_to.buckets.size();j++){
  
 if(ctx.payload.aggregations.forward_to.buckets[j].time_range.buckets[0].doc_count == 0){
list.add(ctx.payload.aggregations.forward_to.buckets[j]);
}
}
ctx.payload.array_new = list;
return ctx.payload.array_new.size() == 0;
"""
    }
  }
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 18, 2019, 1:42pm UTC](https://discuss.elastic.co/t/return-ouput-instead-of-using-a-hard-true-or-false-watcher/195942/14 "2019-09-18T13:42:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.