# Watcher hits return only 10 documents

**URL:** https://discuss.elastic.co/t/watcher-hits-return-only-10-documents/159357
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [December 4, 2018, 12:34pm UTC](https://discuss.elastic.co/t/watcher-hits-return-only-10-documents/159357 "2018-12-04T12:34:47Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Francisca\_Lima](https://avatars.discourse-cdn.com/v4/letter/f/edb3f5/32.png) [@Francisca\_Lima](https://discuss.elastic.co/u/Francisca_Lima)
#### Post date: [December 4, 2018, 12:34pm UTC](https://discuss.elastic.co/t/watcher-hits-return-only-10-documents/159357/1 "2018-12-04T12:34:47Z")

</div>

Hello,

I'm trying to do a chain input in X-Pack Watcher, querying the same index with different filters and aggregating values. I use the results of the aggregation and transform them in a script. However, each aggregation only returns 10 documents/hits.  
How can I use more documents? I tried to change the size to a bigger number, but no success.

Thank you.

---

<div class="post-metadata">

### Author: ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)
#### Post date: [December 4, 2018, 3:38pm UTC](https://discuss.elastic.co/t/watcher-hits-return-only-10-documents/159357/2 "2018-12-04T15:38:28Z")

</div>

Can you provide some more details? What does your request body look like? What does the response look like?

Thanks,  
Nathan

---

<div class="post-metadata">

### Author: ![Francisca\_Lima](https://avatars.discourse-cdn.com/v4/letter/f/edb3f5/32.png) [@Francisca\_Lima](https://discuss.elastic.co/u/Francisca_Lima)
#### Post date: [December 4, 2018, 3:53pm UTC](https://discuss.elastic.co/t/watcher-hits-return-only-10-documents/159357/3 "2018-12-04T15:53:41Z")

</div>

Hello,  
As I explained, I am creating a chain input, first input with data from group "MDMR" and second input with data from group "ECMR". And I want an alert when the key from first group is different from the second group. The problem is, when I'm running the script in actions, since I'm accessing the results of each query in an array, it only appears 10 documents/hits, even trying to increment the size.

> {  
> "trigger": {  
> "schedule": {  
> "interval": "1m"  
> }  
> },  
> "input": {  
> "chain": {  
> "inputs": [  
> {  
> "first": {  
> "search": {  
> "request": {  
> "search\_type": "query\_then\_fetch",  
> "indices": [  
> "monitoring"  
> ],  
> "types": ,  
> "body": {  
> "size": 10000,  
> "query": {  
> "bool": {  
> "must": {  
> "match\_all": {}  
> },  
> "filter": {  
> "bool": {  
> "must": [  
> {  
> "term": {  
> "group.keyword": "MDMR"  
> }  
> }  
> ]  
> }  
> }  
> }  
> },  
> "aggs": {  
> "first\_agg": {  
> "terms": {  
> "field": "monitoring\_date.keyword"  
> }  
> },  
> "aggs": {  
> "first\_value": {  
> "top\_hits": {  
> "docvalue\_fields": [  
> {  
> "field": "value",  
> "format": "use\_field\_mapping"  
> }  
> ],  
> "\_source": "value",  
> "size": 1,  
> "sort": [  
> {  
> "insert\_date": {  
> "order": "desc"  
> }  
> }  
> ]  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> },  
> {  
> "second": {  
> "search": {  
> "request": {  
> "search\_type": "query\_then\_fetch",  
> "indices": [  
> "monitoring"  
> ],  
> "types": ,  
> "body": {  
> "size": 10000,  
> "query": {  
> "bool": {  
> "must": {  
> "match\_all": {}  
> },  
> "filter": {  
> "bool": {  
> "must": [  
> {  
> "term": {  
> "group.keyword": "ECMR"  
> }  
> }  
> ]  
> }  
> }  
> }  
> },  
> "aggs": {  
> "second\_agg": {  
> "terms": {  
> "field": "monitoring\_date.keyword"  
> }  
> },  
> "aggs": {  
> "second\_value": {  
> "top\_hits": {  
> "docvalue\_fields": [  
> {  
> "field": "value",  
> "format": "use\_field\_mapping"  
> }  
> ],  
> "\_source": "value",  
> "size": 1,  
> "sort": [  
> {  
> "insert\_date": {  
> "order": "desc"  
> }  
> }  
> ]  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> ]  
> }  
> },  
> "condition": {  
> "script": {  
> "source": "return true",  
> "lang": "painless"  
> }  
> },  
> "actions": {  
> "my-logging-action": {  
> "transform": {  
> "script": {  
> "source": "def events = ; for(int i=0;i\<ctx.payload.first.aggregations.first\_agg.buckets.length;i++){for (int a=0;a\<ctx.payload.second.aggregations.second\_agg.buckets.length;a++){if (ctx.payload.first.aggregations.first\_agg.buckets[i].key !== ctx.payload.second.aggregations.second\_agg.buckets[a].key){def millis = System.currentTimeMillis(); def event = 'event'; event = ctx.payload.first.aggregations.first\_agg.buckets[i].key+'-MDMR:'+ctx.payload.first.aggregations.first\_agg.buckets[i].first\_value.hits.hits.0.fields.value+'-ECMR:'+ctx.payload.second.aggregations.second\_agg.buckets[a].second\_value.hits.hits.0.fields.value; events.add(event); }}} return events;",  
> "lang": "painless"  
> }  
> },  
> "logging": {  
> "level": "info",  
> "text": "xxx"  
> }  
> }  
> }  
> }

The response shows for each query only 10 aggregated keys and value.

Any idea?

Thank you.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 1, 2019, 3:53pm UTC](https://discuss.elastic.co/t/watcher-hits-return-only-10-documents/159357/4 "2019-01-01T15:53:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.