# Watcher action logging when condition array\_compare

**URL:** <https://discuss.elastic.co/t/watcher-action-logging-when-condition-array-compare/138909>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [July 6, 2018, 12:24pm UTC](https://discuss.elastic.co/t/watcher-action-logging-when-condition-array-compare/138909 "2018-07-06T12:24:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jo\_De\_Troy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jo_de_troy/32/59858_2.png) [@Jo\_De\_Troy](https://discuss.elastic.co/u/Jo_De_Troy)\
**Post date:** [July 6, 2018, 12:24pm UTC](https://discuss.elastic.co/t/watcher-action-logging-when-condition-array-compare/138909/1 "2018-07-06T12:24:08Z")

</div>

Hello,

I've created a watch with a search creating buckets and an array\_compare condition.  
I'd like to have an action that logs only the array elements where the condition is met.  
Like below:  
"condition": {  
"array\_compare": {  
"ctx.payload.aggregations.by\_host.buckets": {  
"path": "averageResponseDuration",  
"gt": {  
"value": "200.",  
"quantifier": "some"  
}  
}  
}  
},  
"actions": {  
"my-logging-action": {  
"logging": {  
"level": "info",  
"text": "For {{ctx.payload.aggregations.by\_host.buckets.key}} averageresponseDuration in too high. Threshold is 200."  
}  
}  
}

But I don't know how I need to write the action logging text to only show the elements of the buckets that meet the condition, What is the best way to get this? Are there any alternatives possible?

Thx  
Jo

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 6, 2018, 12:31pm UTC](https://discuss.elastic.co/t/watcher-action-logging-when-condition-array-compare/138909/2 "2018-07-06T12:31:26Z")

</div>

Two possibilities: First you write a `script` transform in the watch, that filters for those buckets. Or, second, you write a `bucket_selector` pipeline aggregation, see [https://www.elastic.co/guide/en/elasticsearch/reference/6.3/search-aggregations-pipeline-bucket-selector-aggregation.html#search-aggregations-pipeline-bucket-selector-aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/search-aggregations-pipeline-bucket-selector-aggregation.html#search-aggregations-pipeline-bucket-selector-aggregation)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2018, 12:31pm UTC](https://discuss.elastic.co/t/watcher-action-logging-when-condition-array-compare/138909/3 "2018-08-03T12:31:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.