# Using nested aggregation average result in condition

**URL:** <https://discuss.elastic.co/t/using-nested-aggregation-average-result-in-condition/373233>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting, painless, aggregations\
**Created:** [January 15, 2025, 2:35pm UTC](https://discuss.elastic.co/t/using-nested-aggregation-average-result-in-condition/373233 "2025-01-15T14:35:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Harris](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_harris/32/140250_2.png) [@John\_Harris](https://discuss.elastic.co/u/John_Harris)\
**Post date:** [January 15, 2025, 2:35pm UTC](https://discuss.elastic.co/t/using-nested-aggregation-average-result-in-condition/373233/1 "2025-01-15T14:35:23Z")

</div>

When attempting to using a sub aggregation metric average in a condition, I'm receiving

> ```
> "aggregations": {
> "modules": {
> "terms": {
> "field": "host.hostname.keyword",
> "size": 8,
> "min_doc_count": 1
> },
> "aggregations": {
> "metricAgg": {
> "avg": {
> "field": "elapsed_time"
> }
> }
> }
> }
> }
> 
> ```

I'm receiving the following results which provides the metricAgg value that I'm intending to use in a condition but when I attempting to perform a calculation, I'm getting an error as shown below.

```auto
        "aggregations": {
          "modules": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
              {
                "doc_count": 218,
                "metricAgg": {
                  "value": 1.8669724770642202
                },
                "key": "server1"
              }

```

This is the error returning when attempting to Simulate the watcher.

```auto
  "exception": {
    "type": "script_exception",
    "reason": "runtime error",
    "script_stack": [
      "ctx.payload.metricAgg.value >= 1",
      " ^---- HERE"
    ],
    "script": "ctx.payload.metricAgg.value >= 1",
    "lang": "painless",
    "position": {
      "offset": 21,
      "start": 0,
      "end": 32
    },
    "caused_by": {
      "type": "null_pointer_exception",
      "reason": "cannot access method/field [value] from a null def reference",

```

My painless script condition is shown below:

```auto
  "condition": {
    "script": {
      "source": "ctx.payload.metricAgg.value >= 1",
      "lang": "painless"
    }
  },

```