# Unique Field in the watcher action

**URL:** <https://discuss.elastic.co/t/unique-field-in-the-watcher-action/180879>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 13, 2019, 8:21pm UTC](https://discuss.elastic.co/t/unique-field-in-the-watcher-action/180879 "2019-05-13T20:21:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Johnnie843](https://avatars.discourse-cdn.com/v4/letter/j/53a042/32.png) [@Johnnie843](https://discuss.elastic.co/u/Johnnie843)\
**Post date:** [May 13, 2019, 8:21pm UTC](https://discuss.elastic.co/t/unique-field-in-the-watcher-action/180879/1 "2019-05-13T20:21:06Z")

</div>

I'm trying to get the unique values of a certain field in my watch. Is this possible?

For example I want to get the unique log\_module in the following query and put it in my message:

[quote="Johnnie843, post:1, topic:180879, full:true"]  
I'm trying to get the unique values of a certain field in my watch. Is this possible?

For example I want to get the unique messages in the following query and put it in my alert:

```
 "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "(log_module:gmsg) AND (log_message:\" is not reachable\") AND (log_message:Text\\:obt???)"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-7d"
                    }
                  }
                }
              ]
            }
          },
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 22, 2019, 8:15am UTC](https://discuss.elastic.co/t/unique-field-in-the-watcher-action/180879/2 "2019-05-22T08:15:35Z")

</div>

You need to use a [terms aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) for that.

hope this helps!

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2019, 8:15am UTC](https://discuss.elastic.co/t/unique-field-in-the-watcher-action/180879/3 "2019-06-19T08:15:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.