# Watcher, action transform, Help getting "value" from this response

**URL:** <https://discuss.elastic.co/t/watcher-action-transform-help-getting-value-from-this-response/99163>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 1, 2017, 6:39pm UTC](https://discuss.elastic.co/t/watcher-action-transform-help-getting-value-from-this-response/99163 "2017-09-01T18:39:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ross\_C](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@Ross\_C](https://discuss.elastic.co/u/Ross_C)\
**Post date:** [September 1, 2017, 6:39pm UTC](https://discuss.elastic.co/t/watcher-action-transform-help-getting-value-from-this-response/99163/1 "2017-09-01T18:39:38Z")

</div>

I want to alert on error\_percent \> 9, but I don't know how to reference value under the field in the response.  
transactioncount,  
errorcount,  
error\_percent

Can someone help?

Below is the response from my aggregation search,  
"aggregations": {  
"project": {  
"doc\_count\_error\_upper\_bound": 10,  
"sum\_other\_doc\_count": 474,  
"buckets": [  
{  
"key": "RETTransaction-OP\_R1-N1-tst03-1\_root",  
"doc\_count": 2684,  
"errorcount-bucket": {  
"buckets": {  
"Errors": {  
"doc\_count": 2684  
}  
}  
},  
"transactioncount-bucket": {  
"doc\_count\_error\_upper\_bound": 0,  
"sum\_other\_doc\_count": 0,  
"buckets": [  
{  
"key": "RETTransaction-OP\_R1-N1-tst03-1\_root",  
"doc\_count": 2684  
}  
]  
},  
"transactioncount": {  
"value": 2684  
},  
"errorcount": {  
"value": 2684  
},  
"error\_percent": {  
"value": 100  
}  
},  
{  
"key": "CustomerCommunication\_SendComm\_v4\_root",  
"doc\_count": 1405,  
"errorcount-bucket": {  
"buckets": {  
"Errors": {  
"doc\_count": 1405  
}  
}  
},  
"transactioncount-bucket": {  
"doc\_count\_error\_upper\_bound": 0,  
"sum\_other\_doc\_count": 0,  
"buckets": [  
{  
"key": "CustomerCommunication\_SendComm\_v4\_root",  
"doc\_count": 1405  
}  
]  
},  
"transactioncount": {  
"value": 1405  
},  
"errorcount": {  
"value": 1405  
},  
"error\_percent": {  
"value": 100  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 8, 2017, 8:53am UTC](https://discuss.elastic.co/t/watcher-action-transform-help-getting-value-from-this-response/99163/2 "2017-09-08T08:53:14Z")

</div>

There are two `error_percent` fields in your response.

A specific one could be access via `ctx.payload.aggregations.project.buckets.0.error_percent` or `ctx.payload.aggregations.project.buckets.1.error_percent`

There are a couple of solutions now. First you could loop over all the results and find the minimum value. Second you could use a [min\_bucket pipeline agg](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/search-aggregations-pipeline-min-bucket-aggregation.html) to get the minimal value and only compare that one.

Hope this helps.

---

<div class="post-metadata">

**Author:** ![Ross\_C](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@Ross\_C](https://discuss.elastic.co/u/Ross_C)\
**Post date:** [September 8, 2017, 3:32pm UTC](https://discuss.elastic.co/t/watcher-action-transform-help-getting-value-from-this-response/99163/3 "2017-09-08T15:32:35Z")

</div>

I finally got it. Problem is the admins put a clunky we front end on watcher which outputs nothing if there is any error, making it very hard to troubleshoot.  
This works:  
"transform": {  
"script": {  
"inline": "ctx.payload.aggregations.project.buckets.stream().filter(it -\> it.Error\_Percent.value \> 9).map(it -\> ['project\_name':it.key,'err\_percent':Math.round(it.Error\_Percent.value),'errcount':Math.round(it.errorcount.value),'transcount':Math.round(it.transactioncount.value)]).collect(Collectors.toList());",  
"lang": "painless"  
}  
},  
...  
then I can alert slack  
"text": "Below Engines have errors.\n{{#ctx.payload.\_value}}Project Name: {{project\_name}}\tError Percent: {{err\_percent}}%\tTransaction Count: {{transcount}}\tError Count: {{errcount}}\n{{/ctx.payload.\_value}}",

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 6, 2017, 3:32pm UTC](https://discuss.elastic.co/t/watcher-action-transform-help-getting-value-from-this-response/99163/4 "2017-10-06T15:32:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.