# Watcher: comparing two fields from different indexes

**URL:** <https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699>\
**Category:** Elasticsearch\
**Tags:** painless\
**Created:** [June 22, 2021, 7:42pm UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699 "2021-06-22T19:42:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [June 22, 2021, 7:42pm UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699/1 "2021-06-22T19:42:40Z")

</div>

Hi, Im running a chained input watch with two queries: "first" and "second", and comparing the fields partition\_field\_value from "first" against hostname from "second", Im certain that in both indexes exist a partition\_field\_value with the same value as a hostname, but I keep getting this error:

```auto
              "type" : "script_exception",
              "reason" : "runtime error",
              "script_stack" : [
                "java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64)",
                "java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70)",
                "java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:248)",
                "java.base/java.util.Objects.checkIndex(Objects.java:373)",
                "java.base/java.util.ArrayList.get(ArrayList.java:425)",
                "if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) { ",
                " ^---- HERE"
              ],

```

The weird thing is that my condition works and its almost the same code that is in the transform

```auto
    "condition": {
      "script": {
        "source": "for (int i = 0; i < ctx.payload.second.hits.total; ++i) { 
                                if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) { return true;}
                         }",
        "lang": "painless"
      }
    },
    "actions": {
      "my-logging-action": {
        "transform": {
          "script": {
            "source": "ctx.payload.transform = []; 
                       def document = []; 
                       for (int i = 0; i < ctx.payload.second.hits.total; ++i) { 
                          if (ctx.payload.first.hits.hits[i]._source.partition_field_value == ctx.payload.second.hits.hits[i]._source.hostname) {
                             document = ['hostname': ctx.payload.second.hits.hits[i]._source.hostname]; 
                             ctx.payload.transform.add(document) 
                          }
                       } return ctx.payload.transform;",
            "lang": "painless"
          }
        },
        "logging": {
          "level": "warn",
          "text": "true match {{#ctx.payload._value}} {{hostname}} {{/ctx.payload._value}}"
        }
      }
    }

```

When I do both queries outside the watcher, they both return results  
What is wrong with my transform script?

---

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [June 22, 2021, 8:41pm UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699/2 "2021-06-22T20:41:20Z")

</div>

I have changed the condition in the for loop on the transform, and now doesnt throw any errors

from this:

```auto
for (int i = 0; i < ctx.payload.second.hits.total; ++i)

```

to this:

```auto
 for (int i = 0; i < ctx.payload.second.hits.hits.size(); ++i) 

```

Now I have two doubts, they both get the same number? getting the total of hits from the query field total, and using the function size()?

and why , getting the total in the condition works, but doesnt in the transform?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 23, 2021, 12:03pm UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699/3 "2021-06-23T12:03:01Z")

</div>

The size of the hits array depends on the number of documents returned that is set by the `size` parameter.

---

<div class="post-metadata">

**Author:** ![ElasticLiver](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticliver/32/64869_2.png) [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\
**Post date:** [June 23, 2021, 2:25pm UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699/4 "2021-06-23T14:25:08Z")

</div>

Hi, I have no size parameter in my queries.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 29, 2021, 9:00am UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699/5 "2021-06-29T09:00:11Z")

</div>

It defaults to `10`.. also you cannot make it arbitrary big, so you probably will not compare all of your indexed data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2021, 9:00am UTC](https://discuss.elastic.co/t/watcher-comparing-two-fields-from-different-indexes/276699/6 "2021-07-27T09:00:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.