# \[Watcher\]Are chains applied to each document individually?

**URL:** <https://discuss.elastic.co/t/watcher-are-chains-applied-to-each-document-individually/190646>\
**Category:** Elasticsearch\
**Created:** [July 16, 2019, 5:33am UTC](https://discuss.elastic.co/t/watcher-are-chains-applied-to-each-document-individually/190646 "2019-07-16T05:33:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [July 16, 2019, 5:33am UTC](https://discuss.elastic.co/t/watcher-are-chains-applied-to-each-document-individually/190646/1 "2019-07-16T05:33:29Z")

</div>

Hi,

I want to make a Watch that compares hardware alerts with open support tickets and if no matching ticket exist, perform an action such as using webhook to forward data to Logstash or send a API call to my ticket system using webhook.

This first part of the query would retrieve all the `error` and `device-id` fields from the `errors` index over say the past 24 hours. In the second part of the chain I want to compare that data with my incidents index. The `incidents` index will have fields such as `device-id`, `error` and `status`. If there is a matching device-id and error with status == open then the result should be dropped. Documents that have no match (no existing ticket yet) should be send to webhook action so I can use Logstash to send an email for each document. O

The reason I plan on using Logstash is that to my understanding Watcher doesn't loop the action part so it cannot perform a email action on each document that would match the query.

This has me worried the same may apply for Watcher in general. So if my query would return multiple device-id's with errors, it won't apply the status:open check for each document.

Would something like what I'm describing be achievable within a single Watch?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2019, 5:33am UTC](https://discuss.elastic.co/t/watcher-are-chains-applied-to-each-document-individually/190646/2 "2019-08-13T05:33:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.