# Watcher : action index : add or rename field on "foreach"

**URL:** <https://discuss.elastic.co/t/watcher-action-index-add-or-rename-field-on-foreach/231366>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 6, 2020, 2:49pm UTC](https://discuss.elastic.co/t/watcher-action-index-add-or-rename-field-on-foreach/231366 "2020-05-06T14:49:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bricevalenza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bricevalenza/32/110949_2.png) [@bricevalenza](https://discuss.elastic.co/u/bricevalenza)\
**Post date:** [May 6, 2020, 2:50pm UTC](https://discuss.elastic.co/t/watcher-action-index-add-or-rename-field-on-foreach/231366/1 "2020-05-06T14:50:00Z")

</div>

Hi,

I would like to count the number of documents based on a search, in order to follow the evolution of the number of documents.  
I use the watcher for this, which allows me to execute a regular query and retrieve the result.  
On this side everything is OK, and I make an aggregation (count by a field).

in "actions", I send this in an index, my concern is that I would like to change the name of a field and add another field which would be for example: monitor:count\_doc\_by\_company

the result of my search contains the following aggregation:  
` "aggregations" : { "2" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [{ "key" : "COMPANY1", "doc_count" : 223981578 }, { "key" : "COMPANY2", "doc_count" : 3408203 }, { "key" : "UNDEFINED", "doc_count" : 356186 }, { "key" : "COMPANY3", "doc_count" : 122787 }] } }`

my code 'actions" is :  
` "actions": { "index_payload": { "foreach": "ctx.payload.aggregations.2.buckets", "max_iterations": 100, "index": { "index": "eol_compteurs", "execution_time_field": "@timestamp" } } },`

I've tried using "script" but I get errors every time.

here is the result after ingestion in the index eol\_counters :  
` { "_index": "eol_compteurs", "_type": "_doc", "_id": "MGlI6nEB638LGgRIX0cG", "_version": 1, "_score": null, "_source": { "doc_count": 220097723, "@timestamp": "2020-05-06T13:59:02.044Z", "key": "COMPANY1" }, "fields": { "@timestamp": ["2020-05-06T13:59:02.044Z"] }, "sort": [1588773542044] }`

I'd like to add a field with a static value, and change the name of the "key" field, but I do not succeed ☹

Thanks

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 11, 2020, 1:41pm UTC](https://discuss.elastic.co/t/watcher-action-index-add-or-rename-field-on-foreach/231366/2 "2020-05-11T13:41:18Z")

</div>

do not use a `foreach` loop (as this would send.a single index request for each agg), use the `_doc` array of the `index` action to send a single bulk request.

If you need to change the structure of the data, use a transform.

See [https://www.elastic.co/guide/en/elasticsearch/reference/7.6/transform-script.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/transform-script.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2020, 1:41pm UTC](https://discuss.elastic.co/t/watcher-action-index-add-or-rename-field-on-foreach/231366/3 "2020-06-08T13:41:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.