# Running an ESQL query periodally and output the result into an index

**URL:** <https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481>\
**Category:** Kibana\
**Created:** [January 20, 2024, 2:16pm UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481 "2024-01-20T14:16:39Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![lizozom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizozom/32/114932_2.png) [@lizozom](https://discuss.elastic.co/u/lizozom)\
**Post date:** [January 20, 2024, 2:16pm UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/1 "2024-01-20T14:16:39Z")

</div>

I have built an ESQL query that calculates today's inventory of products.  
I want to run it daily and output the result into a different index.

1. I thought of using `Transforms`, could I use an ESQL query there?
2. If not, I thought of using `Watcher` or `TaskManager`, will any of these support `ESQL`?
3. If not, is there another way that I'm missing to achieve this?

Thank you

---

<div class="post-metadata">

**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\
**Post date:** [January 20, 2024, 11:17pm UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/2 "2024-01-20T23:17:23Z")

</div>

Something like [ES|QL : Summary indexing command needed · Issue #101176 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/101176), right?

We want to have that but the details will be discussed after the GA release of ES|QL, which is the current priority (and shouldn't be that far off).

---

<div class="post-metadata">

**Author:** ![lizozom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizozom/32/114932_2.png) [@lizozom](https://discuss.elastic.co/u/lizozom)\
**Post date:** [January 21, 2024, 11:32am UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/3 "2024-01-21T11:32:37Z")

</div>

> [@xeraa](#):
>
> We want to have that but the details will be discussed after the GA release of ES|QL, which is the current priority (and shouldn't be that far off).

Absolutely!

I see the issue suggests this as an `ESQL command` but for example `ESQL` + `Watcher` + a `re-index action` would achieve a similar result.

But I'm sure that there are multiple ways to do it.

Looking forward to see where it goes!

I'd ask you to keep flexibility in mind when you build this feature

---

<div class="post-metadata">

**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\
**Post date:** [January 22, 2024, 3:34am UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/4 "2024-01-22T03:34:55Z")

</div>

If you are desperate then maybe, but I'd consider all these hacks with Watcher pretty much a dead end that should be rewritten another way sooner than later 😅

---

<div class="post-metadata">

**Author:** ![Sunile\_Manjee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunile_manjee/32/111461_2.png) [@Sunile\_Manjee](https://discuss.elastic.co/u/Sunile_Manjee)\
**Post date:** [January 22, 2024, 4:35am UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/5 "2024-01-22T04:35:02Z")

</div>

Full transparency I haven't tested this. Just curious. Have you tried to create a rule using your ESQL along with triggering a index event? Within the index event, use `context_hits`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8e83329715493ca54aa97e15d59888f093d11d75.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9725e89ffaf67bfcf92fc0b90db66e808aabe37.png)

---

<div class="post-metadata">

**Author:** ![lizozom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizozom/32/114932_2.png) [@lizozom](https://discuss.elastic.co/u/lizozom)\
**Post date:** [January 23, 2024, 1:13pm UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/6 "2024-01-23T13:13:42Z")

</div>

> [@Sunile\_Manjee](#):
>
> Full transparency I haven't tested this. Just curious. Have you tried to create a rule using your ESQL along with triggering a index event? Within the index event, use `context_hits`

I will check this out! Interesting!

---

<div class="post-metadata">

**Author:** ![lizozom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizozom/32/114932_2.png) [@lizozom](https://discuss.elastic.co/u/lizozom)\
**Post date:** [January 23, 2024, 1:18pm UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/7 "2024-01-23T13:18:13Z")

</div>

[xeraa](https://discuss.elastic.co/u/xeraa)  
I actually ended up doing something a bit different

1. I created a regular `Transform` that calculates today's inventory
2. I ran a simple `Watcher` that copies those entries to a new `Data stream`. See this [Q\A](https://discuss.elastic.co/t/use-watcher-index-action-with-multiple-documents/351503/2) for reference. It adds the inventory date as an extra field to each document, hence creating an inventory history index.
3. I then used `ES|QL` to query the inventory index.

So at this point, supporting `ESQL` to create that inventory data stream would be a cool addition, but no desperate measures needed to be taken!

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![lizozom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lizozom/32/114932_2.png) [@lizozom](https://discuss.elastic.co/u/lizozom)\
**Post date:** [January 23, 2024, 4:59pm UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/8 "2024-01-23T16:59:09Z")

</div>

[Sunile\_Manjee](https://discuss.elastic.co/u/Sunile_Manjee)  
I'm trying this out and the main thing that prevents me from achieving what I want, is that the document indexed in the action needs to be a new document it seems. But I would like to index the same documents the ESQL query returned.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/5/15cb4ee1cd3ae439229cafc352268892a78d1d09.png)

---

<div class="post-metadata">

**Author:** ![Sunile\_Manjee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunile_manjee/32/111461_2.png) [@Sunile\_Manjee](https://discuss.elastic.co/u/Sunile_Manjee)\
**Post date:** [January 24, 2024, 8:52pm UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/9 "2024-01-24T20:52:38Z")

</div>

> [@Sunile\_Manjee](#):
>
> context\_hits

Isn't that what would reside within `context_hits` ? The ESQL query result. Again I haven't tried this but from my initial analysis, seems interesting.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/8/28d813b64fa52b7b4e8285c0f8999517cb44940f.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2024, 8:53pm UTC](https://discuss.elastic.co/t/running-an-esql-query-periodally-and-output-the-result-into-an-index/351481/10 "2024-02-21T20:53:14Z")

</div>

Closed on February 21, 2024, 8:53pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
