# Watcher Exception - Could Not Parse: Unknown Action Type "foreach"

**URL:** <https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [December 14, 2020, 6:59pm UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631 "2020-12-14T18:59:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ravinb86](https://avatars.discourse-cdn.com/v4/letter/r/c67d28/32.png) [@ravinb86](https://discuss.elastic.co/u/ravinb86)\
**Post date:** [December 14, 2020, 6:59pm UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631/1 "2020-12-14T18:59:00Z")

</div>

Hello There,

I have a basic watcher to see no. of hits based on a query and send an email per hit. i.e. if my query returns 5 hits, I need to be able to send 5 different emails. To loop through the hits in an array: I followed the [elastic documentation link](https://www.elastic.co/guide/en/elasticsearch/reference/current/action-foreach.html)

But, this is throwing an error and not working:

> [parse\_exception] could not parse action [Test/email\_administrator]. unknown action type [foreach]

Below is my Watcher Script:

```
{
  "trigger": {
    "schedule": {
      "interval": "7m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "ai-test-*"
        ],
        "types": [],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "match_phrase": {
                    "Alarms.GenerateSNOW": {
                      "query": "true"
                    }
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-7m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "actions": {
    "email_administrator": {
    "foreach": "ctx.payload.hits.hits",
	"max_iterations" : 500,
      "email": {
        "profile": "standard",
        "priority": "high",
        "to": [
          "email@email.com"
        ],
        "subject": "{{ctx.payload.hits.total}} Alert(s) Reported",
        "body": {
          "html": "<p>Hello Team,<br> <br>This is to notify you that there is ID(s) found in problem state and needs your immediate attention. <br/> <br> <br> Details: <br/> <font color=\"#008000\">{{#ctx.payload.hits.hits}} Distribution ID: {{_source.Alarms.DistrId}}; Error Message: {{_source.Alarms.RMessage}}; Status: {{_source.Alarms.Status}}; Alarm ID: {{_source.Alarms.AlarmId}}; Destination Network: {{_source.Alarms.DistToNet}}; Destination Node: {{_source.Alarms.DistToNode}} <br> <br> {{/ctx.payload.hits.hits}}</font> <b><br><br>Regards,<br>Team Monitoring<br></P>"
        }
      }
    }
  }
}

```

Pls. help.

Thanks,  
Rav

---

<div class="post-metadata">

**Author:** ![prajwalgmpp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prajwalgmpp/32/47707_2.png) [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\
**Post date:** [December 15, 2020, 11:50am UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631/2 "2020-12-15T11:50:58Z")

</div>

Foreach field is available only from Elastic 7.10

---

<div class="post-metadata">

**Author:** ![ravinb86](https://avatars.discourse-cdn.com/v4/letter/r/c67d28/32.png) [@ravinb86](https://discuss.elastic.co/u/ravinb86)\
**Post date:** [December 15, 2020, 6:25pm UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631/3 "2020-12-15T18:25:35Z")

</div>

Does anyone know how to achieve this in 6.8 version?  
@spinscale: Do you think it's possible?

---

<div class="post-metadata">

**Author:** ![ravinb86](https://avatars.discourse-cdn.com/v4/letter/r/c67d28/32.png) [@ravinb86](https://discuss.elastic.co/u/ravinb86)\
**Post date:** [January 5, 2021, 4:40pm UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631/4 "2021-01-05T16:40:15Z")

</div>

Hello, Anyone able to help yet? Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2021, 4:40pm UTC](https://discuss.elastic.co/t/watcher-exception-could-not-parse-unknown-action-type-foreach/258631/5 "2021-02-02T16:40:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.