Specific Alarm Values : bulding an array of JSON elements in the condition scripts

Elastic Stack Elasticsearch
6 
         }
              ]
            }
          }
        },
        "search": {
          "request": {
            "search_type": "query_then_fetch",
            "indices": [
              "new_sbc"
            ],
            "types": [],
            "body": {
              "query": {
                "bool": {
                  "filter": [
                    {
                      "terms": {
                        "oper.keyword": [
                          "START",
                          "STOP"
                        ]
                      }
                    },
                    {
                      "range": {
                        "@timestamp": {
                          "gte": "2017-10-04T20:46:00.000Z",
                          "lte": "2017-10-04T20:46:30.000Z"
                        }
                      }
                    }
                  ]
                }
              },
              "size": 0,
              "aggs": {
                "origin": {
                  "terms": {
                    "field": "from.keyword",
                    "size": 10000,
                    "min_doc_count": 2
                  },
                  "aggs": {
                    "call_ref": {
                      "terms": {
                        "field": "call_ref.keyword",
                        "size": 10000,
                        "min_doc_count": 2
                      },
                      "aggs": {
                        "total_duration": {
                          "sum": {
                            "field": "duration"
                          }
                        }
                      }
                    },
                    "grand_total": {
                      "sum_bucket": {
                        "buckets_path": "call_ref>total_duration"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      },
      "condition": {
        "type": "script",
        "status": "success",
        "met": true
      },
      "actions": [
        {
          "id": "my-logging-action",
          "type": "logging",
          "status": "success",
          "logging": {
            "logged_text": "There are  From: 34606117751: Total 268.0"
          }
        }
      ]
    },
    "messages": []
  }
}