# Return the value of aggs in match query

**URL:** <https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360>\
**Category:** Elasticsearch\
**Created:** [April 11, 2019, 9:06am UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360 "2019-04-11T09:06:35Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![bhushan](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Post date:** [April 11, 2019, 9:06am UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/1 "2019-04-11T09:06:35Z")

</div>

Hi,  
I want to return the value of aggs max in Match query.  
for eg.

{  
"aggs" : {  
"max\_id" : { "max" : { "field" : "id" } }  
}  
}

Value of above needs to be return in  
{  
"query": {"match": {"id": \<max\_id\>}}  
}

Or is there any way where i can create nest query as below  
{  
"query": {"match": { "id":  
{  
"aggs" : {  
"max\_id" : { "max" : { "field" : "id" } }  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 11, 2019, 2:12pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/2 "2019-04-11T14:12:23Z")

</div>

Hey,

can you explain what you are after? Would it be sufficient to have have a query, which sorts by the `id` field and has a size of `1`? This way there would not be a need to use aggs at all.

--Alex

---

<div class="post-metadata">

**Author:** ![bhushan](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Post date:** [April 11, 2019, 2:31pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/3 "2019-04-11T14:31:24Z")

</div>

Hi Alex  
I have 5 records with id 10  
I have 7 records with id 11  
I have 8 records with id 12

now i want to display only records of largest id (i.e id :12 with all 8 records).

thanks,  
Bhushan

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 11, 2019, 2:33pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/4 "2019-04-11T14:33:42Z")

</div>

I see. then you have to split this into two requests. first getting the max id, then executing the query.

---

<div class="post-metadata">

**Author:** ![bhushan](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Post date:** [April 11, 2019, 2:40pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/5 "2019-04-11T14:40:18Z")

</div>

Hi Alex,  
Thanks for the reply.  
But my problem is i am using this query in watcher so whatever condition or query i will be using will be in one single block.

"input": {  
"search": {  
"request": {  
"index": [  
"logs"  
],  
"body": {

```
      "query": {
        "bool": {
          "must": [
            {
              "match": {
                "state": "CRITICAL"
              }
            },
            {
              "match": {
                "instance_id": "max_instance_id"
              }
            }
          ]
        }
      },
      "size": 100,
        "aggs": {
        "max_instance_id": {
          "max": {
            "field": "instance_id"
          }
        }
      }
    }

```

This is what the code is.Please suggest me where the changes should be done.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 11, 2019, 2:45pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/6 "2019-04-11T14:45:18Z")

</div>

Hey,

now we're getting somewhere 🙂 it always makes sense to post your full problem initially so it is easier to come up with solutions.

Luckily you can solve this with watcher. Just use the [chain input](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/input-chain.html) to the max value first, then you can use a [chain transform](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/input-chain.html#_transforming_chained_input_data) to extract the max value and then use a [search input](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/input-chain.html) with that extracted value - you can use the template syntax and access the transformed field like `ctx.payload.second.path` (from the example in the docs).

Hope this helps!

--Alex

---

<div class="post-metadata">

**Author:** ![bhushan](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Post date:** [April 11, 2019, 2:54pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/7 "2019-04-11T14:54:02Z")

</div>

Hi Alex,  
Thanks for the Solution,  
do you have any live example of this type so i can get brief idea , what to be done.  
or you can even modify the above code,so i can get idea how it will look like.

Thanks,  
bhushan

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 11, 2019, 3:13pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/8 "2019-04-11T15:13:23Z")

</div>

the best way would be get started with the chain input from the docs and go from there. If you have problems, please show exactly what they are including the output of the execute watch api, that usually helps a lot to debug.

See [https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches) for some help on debugging watches

---

<div class="post-metadata">

**Author:** ![bhushan](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Post date:** [April 12, 2019, 1:55pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/9 "2019-04-12T13:55:18Z")

</div>

Hi Alex ,  
I used the Chain input For max operation but it gives me 500 internal error.  
Add to a point that the watcher i am using is in sentinl (open source).  
Please suggest , below is the code:

"input": {  
"Chain": {  
"input": [  
{  
"first": {  
"search": {  
"request": {  
"indices": [  
"logs"  
],  
"body": {  
"aggs": {  
"max\_instance\_id": {  
"max": {  
"field": "instance\_id"  
}  
}  
}  
}  
}  
}  
}  
}  
]  
}  
}

Thanks,  
Bhushan

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 12, 2019, 5:28pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/10 "2019-04-12T17:28:44Z")

</div>

please take the time to properly format your code. You can use markdown in here, it will make it a million times easier to read a snippet.

Also, the blog post above included some tricks like the execute watch api, which should be used. This way you can also include the output here to ease debugging and see where the problem actually is, instead of just pasting your input snippet here, again debugging will become much simpler when also seeing the output.

---

<div class="post-metadata">

**Author:** ![bhushan](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Post date:** [April 15, 2019, 1:22pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/11 "2019-04-15T13:22:33Z")

</div>

Hi Alex,  
I am sorry for above code for format.

Error: save watcher : save watcher : index watcher : mapping set to strict, dynamic introduction of [Input] within [sentinl-watcher] is not allowed: [strict\_dynamic\_mapping\_exception] mapping set to strict, dynamic introduction of [Input] within [sentinl-watcher] is not allowed.

for

`"input": { "chain": { "inputs": [{ "first": { "simple": { "path": "/_search" } } }, { "second": { "transform": { "script": "return [ 'path' : 'payload.first.path' + '/']" } } }, { "third": { "http": { "request": { "host": "localhost", "port": 9200, "path": "{{payload.second.path}}" } } } } ] } }`

---

<div class="post-metadata">

**Author:** ![bhushan](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Post date:** [April 15, 2019, 1:28pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/12 "2019-04-15T13:28:56Z")

</div>

Can you please suggest me any other i can get the result?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 15, 2019, 7:10pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/13 "2019-04-15T19:10:14Z")

</div>

Hey,

I'm confused now, what exactly sentinl watcher is. I suppose this some solution not by elastic (please correct me if I am wrong), so you might be better off, asking in the respective support forums about it.

--Alex

---

<div class="post-metadata">

**Author:** ![bhushan](https://avatars.discourse-cdn.com/v4/letter/b/a87d85/32.png) [@bhushan](https://discuss.elastic.co/u/bhushan)\
**Post date:** [April 16, 2019, 9:09am UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/14 "2019-04-16T09:09:05Z")

</div>

Hi Alex,  
Thanks for suggestions you provided till now,  
Atlast i have used {{payload.aggregations.max\_instance\_id.value}} in email body and it does print the perfect value in email.

So is there any way, where i can put if condition in below loop

> {{#ctx.payload.hits.hits}}{{\_id}}|{{/ctx.payload.hits.hits}}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 16, 2019, 4:24pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/15 "2019-04-16T16:24:33Z")

</div>

for watcher you have to use a script transform before the action in order to modify your payload.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2019, 4:24pm UTC](https://discuss.elastic.co/t/return-the-value-of-aggs-in-match-query/176360/16 "2019-05-14T16:24:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.