# Watcher Alert on Agg Field & Painless Script Condition Error

**URL:** <https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060>\
**Category:** Elastic Security\
**Created:** [October 22, 2020, 7:25pm UTC](https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060 "2020-10-22T19:25:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jc034240](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jc034240](https://discuss.elastic.co/u/jc034240)\
**Post date:** [October 22, 2020, 7:25pm UTC](https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060/1 "2020-10-22T19:25:56Z")

</div>

Hello everyone,  
My goal of the Watcher is to fire when the unique count of hosts, from the hostname field drops below 110.

I have tried both .value and .doc\_count in the script portion of the condition but still get the same error.

` "return ctx.payload.aggregations.machine_count.buckets.0.value < params.threshold"`

` "return ctx.payload.aggregations.machine_count.buckets.0.doc_count < params.threshold"`

Below is the error I am receiving and full Watcher text.

Error Received:

```auto
"caused_by" : {
        "type" : "null_pointer_exception",
        "reason" : """Cannot invoke "Object.getClass()" because "callArgs[0]" is null""",
        "stack_trace" : """java.lang.NullPointerException: Cannot invoke "Object.getClass()" because "callArgs[0]" is null

```

Watcher:  
PUT \_watcher/watch/\_execute

```auto
{
"watch": {
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "Index Name"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "_source": "hostname",
          "query": {
            "bool": {
              "must": [],
              "must_not": [
              ],
              "filter": [
                {
                  "term": {
                    "tags": "hostType"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-5m",
                      "to": "now"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "machine_count": {
              "cardinality": {
                "field": "hostname"
              },
              "meta": {
                "name": "UNIQUE_MACHINE_AGG_RESULTS"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.machine_count.buckets.0.value < params.threshold",
      "lang": "painless",
      "params": {
        "threshold": 110
      }
    }
  },
  "actions": {
    "email_alert": {
      "email": {
        "profile": "standard",
        "to": [
          "Email address"
        ],
        "subject": "{{ctx.metadata.name}}",
        "body": {
          "html": ""
        }
      }
    }  
  }
}
} 

```

---

<div class="post-metadata">

**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\
**Post date:** [November 3, 2020, 12:02am UTC](https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060/2 "2020-11-03T00:02:37Z")

</div>

Hey there @jc034240, I think you might want the Elasticsearch forums instead of this one?  
[https://discuss.elastic.co/tag/stack-alerting](https://discuss.elastic.co/tag/stack-alerting)

We do mostly the detection engine which is separate and the reason why I think you're not going to get many replies on this part of the forums

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:16am UTC](https://discuss.elastic.co/t/watcher-alert-on-agg-field-painless-script-condition-error/253060/3 "2022-11-04T08:16:07Z")

</div>