# Watcher - find difference between 2 buckets keys

**URL:** https://discuss.elastic.co/t/watcher-find-difference-between-2-buckets-keys/346863
**Category:** Kibana
**Created:** [November 10, 2023, 11:05am UTC](https://discuss.elastic.co/t/watcher-find-difference-between-2-buckets-keys/346863 "2023-11-10T11:05:49Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![hofrichterovak](https://avatars.discourse-cdn.com/v4/letter/h/ba9def/32.png) [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)
#### Post date: [November 10, 2023, 11:05am UTC](https://discuss.elastic.co/t/watcher-find-difference-between-2-buckets-keys/346863/1 "2023-11-10T11:05:49Z")

</div>

Hello,

I would like to ask for help. I would like to have a watcher that would find the difference between 2 buckets keys.

The goal is to find out if there is a difference in the values of the HOST field now and some time ago and send this difference by email.

Here is what I want:  
values:  
latest5: aa, bb, **cc**  
previous5: aa,bb

**result will be cc**

Value cc is missing. It is situation, that I need send email.

I have result (from watcher action):

```
      "text": """PREVIOUS {{ctx.payload.aggregations.five_min.buckets.previous5.number_of_values.buckets}}
      NOW {{ctx.payload.aggregations.five_min.buckets.latest5.number_of_values.buckets}} """

```

PREVIOUS {0={doc\_count=2246, key= **aa** }, 1={doc\_count=1209, key= **bb** }, 2={doc\_count=1209, key= **cc** }}  
NOW {0={doc\_count=1530, key= **aa** }, 1={doc\_count=744, key= **bb** }}

How can I compare these 2 buckets.keys arrays?

Here is watcher:

```auto
{
  "trigger": {
    "schedule": {
      "interval": "20s"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "yyyyy"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": {
                "range": {
                  "@timestamp": {
                    "from": "now-120m",
                    "to": "now"
                  }
                }
              }
            }
          },
          "aggs": {
            "five_min": {
              "filters": {
                "filters": {
                  "latest5": {
                    "range": {
                      "@timestamp": {
                        "gte": "now-20m",
                        "lte": "now"
                      }
                    }
                  },
                  "previous5": {
                    "range": {
                      "@timestamp": {
                        "gte": "now-120m",
                        "lt": "now-60m"
                      }
                    }
                  }
                }
              },
              "aggs": {
                "number_of_values": {
                  "terms": {
                    "field": "host"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "always": {}
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "to": [
          "xxxxx"
        ],
        "subject": "testtest1",
        "body": {
          "text": """PREVIOUS {{ctx.payload.aggregations.five_min.buckets.previous5.number_of_values.buckets}}
          NOW {{ctx.payload.aggregations.five_min.buckets.latest5.number_of_values.buckets}} """
        }
      }
    }
  }
}

```

Thank you so much. 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 8, 2023, 11:06am UTC](https://discuss.elastic.co/t/watcher-find-difference-between-2-buckets-keys/346863/2 "2023-12-08T11:06:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.