# Watcher not work perfect **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-monitoring, elastic-stack-alerting\ **Created:** [October 4, 2020, 6:50am UTC](https://discuss.elastic.co/t/watcher-not-work-perfect/250886 "2020-10-04T06:50:12Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![lstoneir](https://avatars.discourse-cdn.com/v4/letter/l/b9bd4f/32.png) [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Post date:** [October 4, 2020, 6:50am UTC](https://discuss.elastic.co/t/watcher-not-work-perfect/250886/1 "2020-10-04T06:50:12Z")
i have some aggs like this: ```auto "aggregations" : { "range_by_date" : { "buckets" : [ { "key" : "2020-10-04T06:27:06.912Z-*", "from" : 1.601792826912E12, "from_as_string" : "2020-10-04T06:27:06.912Z", "doc_count" : 38, "fooo" : { "doc_count_error_upper_bound" : 0, "sum_other_doc_count" : 0, "buckets" : [ { "key" : "001", "doc_count" : 2, "drop" : { "value" : 1 } },{ "key" : "002", "doc_count" : 2, "drop" : { "value" : 2 } },{ "key" : "003", "doc_count" : 2, "drop" : { "value" : 5 } },{ "key" : "004", "doc_count" : 2, "drop" : { "value" : 0 } },{ "key" : "005", "doc_count" : 2, "drop" : { "value" : 0 } },{ "key" : "006", "doc_count" : 2, "drop" : { "value" : 0 } },{ "key" : "007", "doc_count" : 2, "drop" : { "value" : 1 } }{ "key" : "008", "doc_count" : 2, "drop" : { "value" : 2 } }{ "key" : "009", "doc_count" : 2, "drop" : { "value" : 1 } }{ "key" : "020", "doc_count" : 2, "drop" : { "value" : 5 } },{ "key" : "021", "doc_count" : 2, "drop" : { "value" : 2 } }] }}]}} ``` in my condition: ```auto ctx.payload.errors = []; ctx.payload.values = ctx.payload.aggregations.range_by_date.buckets[0].fooo.buckets; for(x in ctx.payload.values) { if(x.drop.value > 2) { ctx.payload.errors.add(x.key); } } ``` when i log `ctx.payload.errors` in Log Action i see only "003" however i expect "003, 020" why this happen? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [October 5, 2020, 9:03am UTC](https://discuss.elastic.co/t/watcher-not-work-perfect/250886/2 "2020-10-05T09:03:33Z")
please share your whole watch or the output of the execute watch Api, as it contains the search response. Also you can try to run `Debug.explain(ctx.payload.values)` in your condition, which throws an exception but contains information about that data structure for further debugging. From a 10000 foot view this looks correct and the other bucket should be included as well, but maybe seeing all the detail will reveal something. ---
**Author:** ![lstoneir](https://avatars.discourse-cdn.com/v4/letter/l/b9bd4f/32.png) [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Post date:** [October 5, 2020, 10:24am UTC](https://discuss.elastic.co/t/watcher-not-work-perfect/250886/3 "2020-10-05T10:24:25Z")
> [@spinscale](#): > > `Debug.explain(ctx.payload.values)` i do this and in ctx.payload.values i see 020 key! but in elastic log file it was only 003 ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [October 5, 2020, 10:48am UTC](https://discuss.elastic.co/t/watcher-not-work-perfect/250886/4 "2020-10-05T10:48:01Z")
We can use the [Execute Watch API](https://github.com/elastic/kibana/issues/12751) for a debugging session. ```auto POST _watcher/watch/_execute { "watch": { "trigger": { "schedule": { "interval": "10h" } }, "input": { "simple": { "aggregations": { "range_by_date": { "buckets": [ { "key": "2020-10-04T06:27:06.912Z-*", "from": 1601792826912, "from_as_string": "2020-10-04T06:27:06.912Z", "doc_count": 38, "fooo": { "doc_count_error_upper_bound": 0, "sum_other_doc_count": 0, "buckets": [ { "key": "001", "doc_count": 2, "drop": { "value": 1 } }, { "key": "002", "doc_count": 2, "drop": { "value": 2 } }, { "key": "003", "doc_count": 2, "drop": { "value": 5 } }, { "key": "004", "doc_count": 2, "drop": { "value": 0 } }, { "key": "005", "doc_count": 2, "drop": { "value": 0 } }, { "key": "006", "doc_count": 2, "drop": { "value": 0 } }, { "key": "007", "doc_count": 2, "drop": { "value": 1 } }, { "key": "008", "doc_count": 2, "drop": { "value": 2 } }, { "key": "009", "doc_count": 2, "drop": { "value": 1 } }, { "key": "020", "doc_count": 2, "drop": { "value": 5 } }, { "key": "021", "doc_count": 2, "drop": { "value": 2 } } ] } } ] } } } }, "condition": { "script": """ ctx.payload.errors = []; ctx.payload.values = ctx.payload.aggregations.range_by_date.buckets[0].fooo.buckets; for(x in ctx.payload.values) { if(x.drop.value > 2) { ctx.payload.errors.add(x.key); } } return true; """ }, "actions": { "logme": { "logging": { "text": "{{ctx.payload.errors}}" } } } } } ``` If you run this, you can see both fields being returned properly. This is why I would like to see either the watch history output or the execute watch api of that particular watch, otherwise everything else is just guesswork and won't get us to the solution. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 2, 2020, 10:48am UTC](https://discuss.elastic.co/t/watcher-not-work-perfect/250886/5 "2020-11-02T10:48:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.