# Snapshot watcher - when there are more multiple repositories to be watched

**URL:** <https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246>\
**Category:** Kibana\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting, painless\
**Created:** [August 2, 2021, 5:57pm UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246 "2021-08-02T17:57:07Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![achybala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/achybala/32/136185_2.png) [@achybala](https://discuss.elastic.co/u/achybala)\
**Post date:** [August 2, 2021, 5:57pm UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/1 "2021-08-02T17:57:07Z")

</div>

Hi,

With the help from multiple discussions in this forum, I'm able to create a watcher to look for any snapshots in 'failed' state in a given snapshot repository.

```auto
{
	"trigger": {
		"schedule": {
			"interval": "60s"
		}
	},
	"input": {
		"http": {
			"request": {
				"scheme": "https",
				"host": "hostname",
				"port": 9656,
				"method": "get",
				"path": "/_snapshot/repo_name/_all",
				"params": {},
				"headers": {},
				"auth": {
					"basic": {
						"username": "user",
						"password": "password"
					}
				}
			}
		}
	},
	"condition": {
		"array_compare": {
			"ctx.payload.snapshots": {
				"path": "state",
				"eq": {
					"value": "FAILED"
				}
			}
		}
	},
	"actions": {
		"email_action": {
			"transform": {
				"script": {
					"source": "return ['failed_snapshots' : ctx.payload.snapshots.stream().filter( s -> s.state == 'FAILED').collect(Collectors.toList())]",
					"lang": "painless"
				}
			},
			"email": {
				"profile": "standard",
				"priority": "high",
				"to": [
					"email"
					],
				"subject": "Snapshot Watcher Alert",
				"body": {
					"text": "The following Snapshots failed: {{#ctx.payload.failed_snapshots}} {{snapshot}},{{state}},{{shards}} : {{/ctx.payload.failed_snapshots}} "
				}
			}
		}
	}
}

```

Now, I've multiple repositories to lookout for. How can I loop through multiple repositories for failed snapshots without creating a new watcher for all my individual repos.

Is it possible to use chained input, with first input to fetch all the snapshots available and second input to fetch the snapshots with each repository using {{#ctx.payload.first}}..{{/ctx.payload.first}} ?

appreciate your thoughts/inputs.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 3, 2021, 6:57am UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/2 "2021-08-03T06:57:21Z")

</div>

Have you tried `/_snapshot/_all/_all`?

---

<div class="post-metadata">

**Author:** ![achybala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/achybala/32/136185_2.png) [@achybala](https://discuss.elastic.co/u/achybala)\
**Post date:** [August 3, 2021, 7:07am UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/3 "2021-08-03T07:07:36Z")

</div>

GET \_snapshot/\_all/\_all - gives a repository missing exception.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 3, 2021, 7:36am UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/4 "2021-08-03T07:36:53Z")

</div>

Indeed.. according to the docs this should work, but it does not. A current workaround could be to have more than one input where each calls the snapshots of one repository using the chain input. See [Watcher chain input | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/input-chain.html)

---

<div class="post-metadata">

**Author:** ![achybala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/achybala/32/136185_2.png) [@achybala](https://discuss.elastic.co/u/achybala)\
**Post date:** [August 3, 2021, 10:54am UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/5 "2021-08-03T10:54:18Z")

</div>

If chain input is used, is it possible to process and return more than one value in my transform ? I'll have to process ctx.payload.first and ctx.payload.second seperately, and return failed snapshots ? is return more than one value possible?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 3, 2021, 11:12am UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/6 "2021-08-03T11:12:35Z")

</div>

you can return a hashmap in your transform like `return ["a":"first", "b": "second"]`

---

<div class="post-metadata">

**Author:** ![achybala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/achybala/32/136185_2.png) [@achybala](https://discuss.elastic.co/u/achybala)\
**Post date:** [August 4, 2021, 2:07pm UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/7 "2021-08-04T14:07:12Z")

</div>

Thank you Alex. It works.

One more question though. In this case, i'm working with snapshots and not a search. So, ctx.payload.hits.hits/total won't help me isnt it? Is there a way to get the count of snapshots or any non-search input, in the payload ?

---

<div class="post-metadata">

**Author:** ![achybala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/achybala/32/136185_2.png) [@achybala](https://discuss.elastic.co/u/achybala)\
**Post date:** [August 7, 2021, 1:39pm UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/8 "2021-08-07T13:39:38Z")

</div>

@spinscale , any help appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2021, 1:39pm UTC](https://discuss.elastic.co/t/snapshot-watcher-when-there-are-more-multiple-repositories-to-be-watched/280246/9 "2021-09-04T13:39:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.