# Watcher alert telegram count fields
**URL:** https://discuss.elastic.co/t/watcher-alert-telegram-count-fields/227247
**Category:** Elasticsearch
**Created:** [April 9, 2020, 6:14am UTC](https://discuss.elastic.co/t/watcher-alert-telegram-count-fields/227247 "2020-04-09T06:14:14Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Silver](https://discuss.elastic.co/u/Silver)
#### Post date: [April 9, 2020, 6:14am UTC](https://discuss.elastic.co/t/watcher-alert-telegram-count-fields/227247/1 "2020-04-09T06:14:15Z")
The watcher script should be able to calculate the total.hits for each user and show the count based on it. Right now my query is flooding with too many duplicate entries.
````auto
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"winlogbeat-*"
],
"types": [],
"body": {
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"from": "now-5m",
"to": "now"
}
}
},
{
"match": {
"winlog.event_id": "4624"
}
}
]
}
},
"aggs": {
"users": {
"terms": {
"field": "winlog.event_data.TargetUserName.keyword",
"size": 5
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 2
}
}
}
,
"actions": {
"webhook_1": {
"transform": {
"script": {
"source": "['items': ctx.payload.hits.hits.collect(hit -> ['User': hit._source.winlog.event_data.TargetUserName, 'Host': hit._source.host.name, 'color': 'danger'])]",
"lang": "painless"
}
},
"webhook": {
"scheme": "https",
"host": "api.telegram.org",
"port": 443,
"method": "post",
"path": "/bot1083[hidden]/sendMessage",
"params": {},
"headers": {
"Content-Type": "application/x-www-form-urlencoded"
},
"body": "chat_id=-[hidden]&text={{#toJson}}ctx.payload{{/toJson}}"
}
}
}
}```
````
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 7, 2020, 6:14am UTC](https://discuss.elastic.co/t/watcher-alert-telegram-count-fields/227247/2 "2020-05-07T06:14:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.