# Watcher document

**URL:** <https://discuss.elastic.co/t/watcher-document/380635>\
**Category:** Elasticsearch\
**Created:** [July 31, 2025, 5:18pm UTC](https://discuss.elastic.co/t/watcher-document/380635 "2025-07-31T17:18:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [July 31, 2025, 5:18pm UTC](https://discuss.elastic.co/t/watcher-document/380635/1 "2025-07-31T17:18:07Z")

</div>

Hello Team,

I want to show value of a document if there is hits . Below is the watcher script

```auto
{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "logs-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "should": [
                {
                  "term": {
                    "client_ip.keyword": {
                      "value": "10.0.0.9"
                    }
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1h",
                      "lte": "now"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "There are {{ctx.payload.hits.total}} hits and the value is {{ctx.payload.result.0.value"}}
      }
    }
  }
}

```

But i am getting only hits and not getting value.

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [August 1, 2025, 3:18am UTC](https://discuss.elastic.co/t/watcher-document/380635/2 "2025-08-01T03:18:08Z")

</div>

Hello @Aniket_Pant

1. Typo in your action i.e. quotes are before }} it should be after }}

`"text": "There are {{ctx.payload.hits.total}} hits and the value is {{ctx.payload.result.0.value"}}`

to

`"text": "There are {{ctx.payload.hits.total}} hits and the value is {{ctx.payload.result.0.value}}"`

1. For size = 0 we have below values :

```auto
{{ctx.payload.hits.total}} is 244 hits 
{{ctx.payload}} is {_shards={total=1, failed=0, successful=1, skipped=0}, hits={hits=[], total=244, max_score=null}, took=0, timed_out=false}

```

1. If you want to extract the value size = 5 (will extract 5 documents)

Use below  
`{{#ctx.payload.hits.hits}}{{_source.clientip}}, {{/ctx.payload.hits.hits}}`

In my case field name is "clientip"

Values extracted :

`"logged_text": "There are 244 hits and the values are 132.186.182.124, 132.186.182.124, 132.186.182.124, 132.186.182.124, 132.186.182.124, "`

Thanks!!