# There is no match between one term and another in the result of a watcher

**URL:** <https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 27, 2021, 3:52pm UTC](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254 "2021-09-27T15:52:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [September 27, 2021, 3:52pm UTC](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254/1 "2021-09-27T15:52:08Z")

</div>

very good day,  
I have a problem with an alert when I get a result of several terms, i.e. the first term does not match the second, for example.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00f135f44c3f2a9ac9d93a09472d5982bccef7d3.png)

As you can see in the red circle the term "ADUANILLA DE PAIBA" has the IP "10.80.10.101" and in the result when I run my watcher the same IP does not appear, I mean that it does not match, it comes out with another IP that does not correspond to it.

```auto

"actions": [
      {
        "id": "email_1",
        "type": "email",
        "status": "simulated",
        "email": {
          "message": {
            "id": "email_1 __inlined__ 975a4c18-de54-4fee-862d-84d510bef85c-2021-09-27T15:50:33.947816Z_29049",
            "sent_date": "2021-09-27T15:50:33.953284Z",
            "to": [
              "juan.jaramillo@megadvantage.com",
              "victor.vera@megadvantage.com"
            ],
            "bcc": [
              "juancho.jaramillo16@gmail.com"
            ],
            "subject": "Estado UPS Distrital ",
            "body": {
              "text": "\n\n El estado de la UPS ADUANILLA DE PAIBA con la IP 10.16.10.102 Esta Modo Normal\n\n\n \n\n •Para mas informacion ingrese al siguiente enlace:\n \n https://72dfe17217744236af40cc31b704a664.us-central1.gcp.cloud.es.io:9243/s/distrital/app/kibana#/dashboard/c3aa6120-fba9-11eb-ab41-13c85c32210d\n \n "
            }
          }
        }
      }
    ]
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [September 27, 2021, 3:53pm UTC](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254/2 "2021-09-27T15:53:20Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cd9e207aa30e7b5818ce9044489ced2c9b5a33ef.png)

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [September 27, 2021, 3:53pm UTC](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254/3 "2021-09-27T15:53:49Z")

</div>

This is my code:

```auto
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "ups-distrital*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "now-5m/m",
                    "lt": "now/m"
                  }
                }
              }
            }
          },
          "aggs": {
            "terms1": {
              "terms": {
                  "size": 1,
                "field": "Name.keyword"
              }
            },
            "terms2": {
              "terms": {
                  "size": 1,
                "field": "IP.keyword"
              }
            },
            "terms3": {
              "terms": {
                "field": "upsState.keyword"
              }
            },
            "metricAgg": {
              "max": {
                "field": "State"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "if (ctx.payload.aggregations.metricAgg.value > params.threshold) { return true; } return false;",
      "lang": "painless",
      "params": {
        "threshold": 2
      }
    }
  },
  "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "yaml"
        },
        "to": [
          "juan.jaramillo@megadvantage.com",
          "victor.vera@megadvantage.com"
        ],
        "bcc": [
          "juancho.jaramillo16@gmail.com"
        ],
        "subject": "{{ctx.metadata.name}} ",
        "body": {
          "text": """

        El estado de la UPS {{ctx.payload.terms1.buckets.0.key}} con la IP {{ctx.payload.terms2.buckets.0.key}} Esta {{ctx.payload.terms3.buckets.0.key}}

          

          •Para mas informacion ingrese al siguiente enlace:
          
          https://72dfe17217744236af40cc31b704a664.us-central1.gcp.cloud.es.io:9243/s/distrital/app/kibana#/dashboard/c3aa6120-fba9-11eb-ab41-13c85c32210d
          
          """
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": """
        return [
        'local_execution_time' : ctx.trigger.triggered_time.withZoneSameInstant(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss')),
        'terms1' : ctx.payload.aggregations.terms1,
        'terms2' : ctx.payload.aggregations.terms2,
        'terms3' : ctx.payload.aggregations.terms3,
        'metricAgg' : ctx.payload.aggregations.metricAgg.value
          ]
      """,
      "lang": "painless"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2021, 3:54pm UTC](https://discuss.elastic.co/t/there-is-no-match-between-one-term-and-another-in-the-result-of-a-watcher/285254/4 "2021-10-25T15:54:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.