# Watcher - display for each bucket, its corresponding sub buckets results
**URL:** https://discuss.elastic.co/t/watcher-display-for-each-bucket-its-corresponding-sub-buckets-results/269620
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [April 8, 2021, 4:00pm UTC](https://discuss.elastic.co/t/watcher-display-for-each-bucket-its-corresponding-sub-buckets-results/269620 "2021-04-08T16:00:43Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@toms130](https://discuss.elastic.co/u/toms130)
#### Post date: [April 8, 2021, 4:00pm UTC](https://discuss.elastic.co/t/watcher-display-for-each-bucket-its-corresponding-sub-buckets-results/269620/1 "2021-04-08T16:00:43Z")
Hi there,
I've a query result like this :
```auto
"aggregations": {
"backend": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 92,
"client_ip": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 92,
"key": "12.12.11.10"
}
]
},
"key": "ws1r"
},
{
"doc_count": 56,
"client_ip": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 56,
"key": "14.225.114.15"
}
]
},
"key": "ws14"
},
{
"doc_count": 52,
"client_ip": {
"doc_count_error_upper_bound": 0,
"sum_other_doc_count": 0,
"buckets": [
{
"doc_count": 40,
"key": "77.27.105.10"
},
{
"doc_count": 12,
"key": "100.150.105.10"
}
]
},
"key": "web"
}
]
}
}
```
I'd like to display for each backend bucket, its corresponding sub buckets result, but I can't find how to do this, the best I can have is always the first sub aggreation result.
I have
```auto
ws1r: 92 , including 12.12.11.10 : 92
ws14: 56 , including 12.12.11.10 : 92
web: 52 , including 12.12.11.10 : 92
```
I'd like to have
```auto
ws1r_camper: 92 , including 12.12.11.10 : 92
ws14: 56 , including 14.225.114.15 : 56
web: 52 , including 77.27.105.10 : 40 ; 100.150.105.10 : 12
```
Below my watcher :
```auto
{
"trigger" : {
"schedule" : {
"interval": "12h"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"haproxy*"
],
"rest_total_hits_as_int": true,
"body": {
"aggs": {
"backend": {
"terms": {
"field": "backend_name.keyword"
},
"aggs": {
"client_ip": {
"terms": {
"field": "client_ip",
"order": {
"_count": "desc"
},
"size": 3
}
}
}
}
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
}
],
"_source": {
"excludes": []
},
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"should": [
{
"match": {
"http_status_code": 429
}
}
],
"minimum_should_match": 1
}
},
{
"range": {
"@timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-12h",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": []
}
},
"sort": [{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}],
"size": 15
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"actions": {
"webhook_prod": {
"webhook": {
"scheme": "https",
"host": "discordapp.com",
"port": 443,
"method": "post",
"path": "api/webhooks/xxx",
"params": {},
"headers": {},
"body": """{ "content": "{{ctx.metadata.name}} alert - There are {{ctx.payload.hits.total}} errors 429 on last 12 hours on haproxy backends:\n{{#ctx.payload.aggregations.backend.buckets}}{{key}}: {{doc_count}} , including {{#ctx.payload.aggregations.backend.buckets.0.client_ip.buckets}}{{key}} : {{doc_count}} - {{/ctx.payload.aggregations.backend.buckets.0.client_ip.buckets}}\n{{/ctx.payload.aggregations.backend.buckets}}}"""
}
}
}
}
```
How can I loop with `{{ctx.payload.aggregations.backend.buckets.0.client_ip.buckets}`, I know 0 is not good but I can't find how to do this.
best regards
thomas
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 6, 2021, 4:01pm UTC](https://discuss.elastic.co/t/watcher-display-for-each-bucket-its-corresponding-sub-buckets-results/269620/2 "2021-05-06T16:01:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.