# Watcher - loop through results of the first search and use them for the second search

**URL:** https://discuss.elastic.co/t/watcher-loop-through-results-of-the-first-search-and-use-them-for-the-second-search/317518
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [October 26, 2022, 12:29pm UTC](https://discuss.elastic.co/t/watcher-loop-through-results-of-the-first-search-and-use-them-for-the-second-search/317518 "2022-10-26T12:29:47Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)
#### Post date: [October 26, 2022, 12:29pm UTC](https://discuss.elastic.co/t/watcher-loop-through-results-of-the-first-search-and-use-them-for-the-second-search/317518/1 "2022-10-26T12:29:47Z")

</div>

Hi,

I'd like to use every hit of the first result as a parameter for the second search. And after condition checking start an action.

What I mean:

```auto
 for result1 in first_search_results:
    for result2 in second_search_results:
      if result1.some_field == result2.some_field:
        counter += 1
      endif
    endfor
    if counter == 0:
        do some_action
    endif
    counter = 0
endfor

```

Is it possible to do?

---

<div class="post-metadata">

### Author: ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [November 3, 2022, 5:58pm UTC](https://discuss.elastic.co/t/watcher-loop-through-results-of-the-first-search-and-use-them-for-the-second-search/317518/2 "2022-11-03T17:58:17Z")

</div>

Watcher has chained inputs and you can pass something from the results of the first input chain into a subsequent input chain (i.e. perhaps you want to query something in the 2nd search that filters (and only matches) some attribute from the 1st search results.

You can then use code in a transform block to compare any aspect of the output of the input chains and/or calculate some net result.

See a few examples:

Chain inputs: [insight\_watch.json · GitHub](https://gist.github.com/richcollier/7e5603c366b9fcece6f1a8b1b3cf4d3f)  
Transform code: [Alert only on 3 consecutive anomalies above a certain summed score · GitHub](https://gist.github.com/richcollier/31e4de8773d6f9183a6cf4799836b8e0)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 1, 2022, 5:59pm UTC](https://discuss.elastic.co/t/watcher-loop-through-results-of-the-first-search-and-use-them-for-the-second-search/317518/3 "2022-12-01T17:59:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.