# Watcher sub-aggregation count alert

**URL:** <https://discuss.elastic.co/t/watcher-sub-aggregation-count-alert/103619>\
**Category:** Elasticsearch\
**Created:** [October 11, 2017, 9:29pm UTC](https://discuss.elastic.co/t/watcher-sub-aggregation-count-alert/103619 "2017-10-11T21:29:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![theflakes](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@theflakes](https://discuss.elastic.co/u/theflakes)\
**Post date:** [October 11, 2017, 9:29pm UTC](https://discuss.elastic.co/t/watcher-sub-aggregation-count-alert/103619/1 "2017-10-11T21:29:28Z")

</div>

I can create Watcher alerts on aggregations but what I'm struggling with is how do I create a Watcher alert on sub-aggs where the number of sub-aggs in the one top level agg bucket is greater than, say, 5? Thanks

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 12, 2017, 7:14am UTC](https://discuss.elastic.co/t/watcher-sub-aggregation-count-alert/103619/2 "2017-10-12T07:14:36Z")

</div>

can you be more specific where the problem is?

providing a full blown example with an example search response, and what you want to check for would be of tremendous help.

Thanks!

--Alex

---

<div class="post-metadata">

**Author:** ![theflakes](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@theflakes](https://discuss.elastic.co/u/theflakes)\
**Post date:** [October 12, 2017, 1:21pm UTC](https://discuss.elastic.co/t/watcher-sub-aggregation-count-alert/103619/3 "2017-10-12T13:21:06Z")

</div>

I finally figured it out. Have to use the "cardinality" aggregation to count the number of buckets in my sub-aggregation. Basically I just wanted to see how many buckets were in a sub-aggregation and didn't care about the doc count for those sub-aggregations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2017, 1:21pm UTC](https://discuss.elastic.co/t/watcher-sub-aggregation-count-alert/103619/4 "2017-11-09T13:21:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.