# Watcher that counts the documents that arrive to an index in kibana

**URL:** <https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 19, 2021, 4:45pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609 "2021-04-19T16:45:55Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 19, 2021, 4:45pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/1 "2021-04-19T16:45:55Z")

</div>

I have a problem with this watcher, I need to get the number of samples of an index, that is, the count of the documents sent by heartbeat to kibana and send an email every day with the number of documents that arrived that day, for example this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f86cdd03faa1a9ccc0537f397f3d99de954f7e29.png)

This is code in watcher:

```auto
{
  "trigger": {
    "schedule": {
      "daily": {
        "at": [
          "14:00"
        ]
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 1,
          "query": {
              "bool":{
                  "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
                ],
          "aggs": {
              "terms": {
                "field": "_index"
              }
      }
    }
              }
          }
        }
      }
    
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "yaml"
        },
        "to": [
          "victor.vera@megadvantage.com",
          "juan.jaramillo@megadvantage.com"
        ],
        "bcc": [
          "juancho.jaramillo16@gmail.com"
        ],
        "subject": "{{ctx.metadata.name}}",
        "body": {
          "text": """Buen dia, 

 ⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas {{ctx.payload.hits.total}}
{{ctx. payload.result}}
 Estado: UP🟢 

 🕧Hora: {{ctx.payload.time_triggered}} {{ctx.result.execution_time}}

 Área: Networking 
 
🔔Mensaje Alerta: Por favor no responder a este mensaje 

 """
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "return ['time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))];",
      "lang": "painless"
    }
  }
}

```

Error:

```auto
{
  "watch_id": "_inlined_",
  "node": "ELuSGxpSRICZb2ZHJp4paA",
  "state": "failed",
  "user": "elastic",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2021-04-19T16:45:41.246Z"
    },
    "actions": {
      "email_1": {
        "ack": {
          "timestamp": "2021-04-19T16:45:41.246Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "failed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2021-04-19T16:45:41.246Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2021-04-19T16:45:41.246Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 1,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ],
              "aggs": {
                "terms": {
                  "field": "_index"
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "metadata": {
    "name": "Estado herramienta monitoreo",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2021-04-19T16:45:41.246Z",
    "execution_duration": 0,
    "input": {
      "type": "search",
      "status": "failure",
      "error": {
        "root_cause": [
          {
            "type": "x_content_parse_exception",
            "reason": "[1:96] [bool] unknown field [aggs]"
          }
        ],
        "type": "x_content_parse_exception",
        "reason": "[1:96] [bool] unknown field [aggs]"
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 1,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1d/d",
                        "lt": "now/d"
                      }
                    }
                  }
                ],
                "aggs": {
                  "terms": {
                    "field": "_index"
                  }
                }
              }
            }
          }
        }
      }
    },
    "actions": []
  },
  "messages": [
    "failed to execute watch input"
  ]
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 20, 2021, 5:36am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/2 "2021-04-20T05:36:47Z")

</div>

Not to distract you too much but you don't need watcher for that you could just build a simple dashboard or saved search or table with those metrics on it and generate a report and send it each day.

With respect to the watcher your query is malformed, as the error states the `aggs` appears to be inside the `bool` block it should not be there.

I always just test the query in Dev tools first before putting it in the watcher, it is easier to debug that way.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 20, 2021, 3:48pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/3 "2021-04-20T15:48:15Z")

</div>

Ok, I think you did not understand me about what I need. look I need a watcher, because I want to activate that alert every day automatically, and send an email to some people, with the number of documents that sent heartbeat to kibana that day. so I discard the board and displays, because it does not work, you have to send an email alert, for that reason must be a watcher, I hope you can help me, thank you very much friend!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 20, 2021, 3:53pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/4 "2021-04-20T15:53:36Z")

</div>

Watcher is fine.

Your query is malformed as I stated above.

Also for anyone else reading this thread in the future, Reports can be automatically generated each day/ hour / week etc at a specific time and sent via email.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 20, 2021, 4:13pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/5 "2021-04-20T16:13:04Z")

</div>

Thank's and how do I specify to send me an email with the number of documents for a single day? I haven't seen the option

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 20, 2021, 4:57pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/6 "2021-04-20T16:57:45Z")

</div>

Query

```
GET heartbeat-*/_search
{
  "size" : 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "@timestamp": {
              "gte": "now-1d/d",
              "lt": "now/d"
            }
          }
        }
      ]
    }
  },
  "aggs": {
    "heartbeat_count": {
      "value_count": {
        "field": "_index"
      }
    }
  }
}

```

results

```
{
  "took" : 11,
  "timed_out" : false,
  "_shards" : {
    "total" : 11,
    "successful" : 11,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : null,
    "hits" : []
  },
  "aggregations" : {
    "heartbeat_count" : {
      "value" : 60474 <!--- The number of documents 
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 20, 2021, 5:35pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/7 "2021-04-20T17:35:57Z")

</div>

Thanks, it works very well, but I just need to see the results in the email message, I don't know why I don't see it ?

```auto
{
  "trigger": {
    "schedule": {
      "daily": {
        "at": [
          "14:00"
        ]
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 10
      }
    }
  },
  "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "yaml"
        },
        "to": [
          "victor.vera@megadvantage.com",
          "juan.jaramillo@megadvantage.com"
        ],
        "bcc": [
          "juancho.jaramillo16@gmail.com"
        ],
        "subject": "{{ctx.metadata.name}}",
        "body": {
          "text": """Buen dia, 

 ⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas Hits Total: {{ctx.payload.hits.total}} 
 
 The number of documents: {{ctx.aggregations.heartbeat_count.value}} {{ctx.payload.result}} 
 
 Estado: UP🟢 

 🕧Hora: {{ctx.payload.time_triggered}} {{ctx.result.execution_time}}

 Área: Networking 
 
🔔Mensaje Alerta: Por favor no responder a este mensaje 

 """
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "return ['time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))];",
      "lang": "painless"
    }
  }
}

```

```auto
{
  "watch_id": "_inlined_",
  "node": "ELuSGxpSRICZb2ZHJp4paA",
  "state": "executed",
  "user": "elastic",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2021-04-20T17:32:52.755Z"
    },
    "last_checked": "2021-04-20T17:32:52.755Z",
    "last_met_condition": "2021-04-20T17:32:52.755Z",
    "actions": {
      "email_1": {
        "ack": {
          "timestamp": "2021-04-20T17:32:52.755Z",
          "state": "ackable"
        },
        "last_execution": {
          "timestamp": "2021-04-20T17:32:52.755Z",
          "successful": true
        },
        "last_successful_execution": {
          "timestamp": "2021-04-20T17:32:52.755Z",
          "successful": true
        }
      }
    },
    "execution_state": "executed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2021-04-20T17:32:52.755Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2021-04-20T17:32:52.755Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 10
      }
    }
  },
  "metadata": {
    "name": "Estado herramienta monitoreo",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2021-04-20T17:32:52.755Z",
    "execution_duration": 10,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 8,
          "failed": 0,
          "successful": 8,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 10000,
          "max_score": null
        },
        "took": 8,
        "timed_out": false,
        "aggregations": {
          "heartbeat_count": {
            "value": 82077
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1d/d",
                        "lt": "now/d"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "heartbeat_count": {
                "value_count": {
                  "field": "_index"
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          "ctx.payload.hits.total": 10000
        }
      }
    },
    "transform": {
      "type": "script",
      "status": "success",
      "payload": {
        "time_triggered": "2021-04-20 12:32:52"
      }
    },
    "actions": [
      {
        "id": "email_1",
        "type": "email",
        "status": "simulated",
        "email": {
          "message": {
            "id": "email_1 __inlined__ 3129c56b-8ae8-4981-b664-fcb6cb511672-2021-04-20T17:32:52.755402Z_26840",
            "sent_date": "2021-04-20T17:32:52.765741Z",
            "to": [
              "victor.vera@megadvantage.com",
              "juan.jaramillo@megadvantage.com"
            ],
            "bcc": [
              "juancho.jaramillo16@gmail.com"
            ],
            "subject": "Estado herramienta monitoreo",
            "body": {
              "text": "Buen dia, \n\n ⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas Hits Total: \n \n The number of documents: \n \n Estado: UP🟢 \n\n 🕧Hora: 2021-04-20 12:32:52 \n\n Área: Networking \n \n🔔Mensaje Alerta: Por favor no responder a este mensaje \n\n "
            }
          }
        }
      }
    ]
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 20, 2021, 5:51pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/8 "2021-04-20T17:51:06Z")

</div>

> [@Juan\_David\_Jaramillo](#):
>
> ```auto
> "condition": {
> "type": "compare",
> "status": "success",
> "met": true,
> "compare": {
> "resolved_values": {
> "ctx.payload.hits.total": 10000 <! - This is not correct I would think you would want to compare to the heartbeat_count etc... 
> }
> }
> },
> 
> ```

That is not my area of expertise but from above I would think you would want to compare to the heartbeat\_count etc... not hits total it is going to be something like

`ctx.payload.aggregations.heartbeat_count`

Plus if you want it in the actual email you will need to reference that count.

Perhaps look at this sample [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/watching-meetup-data.html) to give you an idea

There is also a ton of sample watched [here](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches)

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 10:25pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/9 "2021-04-23T22:25:04Z")

</div>

I have already added, but I get false mira and it does not run.

```auto
{
  "watch_id": "_inlined_",
  "node": "ELuSGxpSRICZb2ZHJp4paA",
  "state": "execution_not_needed",
  "user": "elastic",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2021-04-23T22:24:07.992Z"
    },
    "last_checked": "2021-04-23T22:24:07.993Z",
    "actions": {
      "email_1": {
        "ack": {
          "timestamp": "2021-04-23T22:24:07.992Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "execution_not_needed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2021-04-23T22:24:07.993Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2021-04-23T22:24:07.993Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count": {
        "gt": 0
      }
    }
  },
  "metadata": {
    "name": "Estado herramienta monitoreo",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2021-04-23T22:24:07.993Z",
    "execution_duration": 13,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 8,
          "failed": 0,
          "successful": 8,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 10000,
          "max_score": null
        },
        "took": 12,
        "timed_out": false,
        "aggregations": {
          "heartbeat_count": {
            "value": 82079
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1d/d",
                        "lt": "now/d"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "heartbeat_count": {
                "value_count": {
                  "field": "_index"
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": false,
      "compare": {
        "resolved_values": {
          "ctx.payload.aggregations.heartbeat_count": {
            "value": 82079
          }
        }
      }
    },
    "actions": []
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 10:25pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/10 "2021-04-23T22:25:39Z")

</div>

```auto
"condition": {
      "type": "compare",
      "status": "success",
      "met": false,
      "compare": {
        "resolved_values": {
          "ctx.payload.aggregations.heartbeat_count": {
            "value": 82079
          }
        }
      }
    },

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 10:26pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/11 "2021-04-23T22:26:04Z")

</div>

```auto
"condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count": {
        "gt": 0
      }
    }
  },

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 10:45pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/12 "2021-04-23T22:45:38Z")

</div>

> [@Juan\_David\_Jaramillo](#):
>
> ` "ctx.payload.aggregations.heartbeat_count":`

That should be correct

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 10:47pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/13 "2021-04-23T22:47:23Z")

</div>

> [@stephenb](#):
>
> "ctx.payload.aggs.heartbeat\_count"

  
no also does not appear

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 10:52pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/14 "2021-04-23T22:52:37Z")

</div>

```auto
 "condition": {
      "type": "compare",
      "status": "success",
      "met": false,
      "compare": {
        "resolved_values": {
          "ctx.payload.aggs.heartbeat_count": null
        }
      }
    },

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 10:58pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/15 "2021-04-23T22:58:32Z")

</div>

![Screen Shot 2021-04-23 at 3.53.13 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f15bf4ba8eb3f0ba460278b55fbd94c06a86ffb.png)

```
   {
  "trigger": {
    "schedule": {
      "interval": "15s"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count.value": {
        "gte": 1000
      }
    }
  },
  "actions": {
    "notify-slack": {
      "slack": {
        "message": {
          "to": [
            "#stephenb-es-integration"
          ],
          "text": "{{ctx.metadata.name}} : Encountered {{ctx.payload.aggregations.heartbeat_count.value}} heartbeats in the last 1 day"
        }
      }
    }
  }
}

```

 ![Screen Shot 2021-04-23 at 3.53.19 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/3/73e0b7a0a2b1515d19a39388c76d8dc9cc24f8b8.jpeg)

Then Simulate

 ![Screen Shot 2021-04-23 at 3.53.26 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7ccfc44254e2018d9004bd40b42c9fcf8a7bd870.png)

 ![Screen Shot 2021-04-23 at 3.53.33 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e5fbc5ec350d7a4b9b5caee03c0b0f67b99bc289.png)

```auto
{
  "watch_id": "_inlined_",
  "node": "QtKLeIcuTWuHdo8uLOcLUw",
  "state": "executed",
  "user": "elastic",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2021-04-24T00:01:20.068Z"
    },
    "last_checked": "2021-04-24T00:01:20.068Z",
    "last_met_condition": "2021-04-24T00:01:20.068Z",
    "actions": {
      "notify-slack": {
        "ack": {
          "timestamp": "2021-04-24T00:01:20.068Z",
          "state": "ackable"
        },
        "last_execution": {
          "timestamp": "2021-04-24T00:01:20.068Z",
          "successful": true
        },
        "last_successful_execution": {
          "timestamp": "2021-04-24T00:01:20.068Z",
          "successful": true
        }
      }
    },
    "execution_state": "executed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2021-04-24T00:01:20.068Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2021-04-24T00:01:20.068Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count.value": {
        "gte": 1000
      }
    }
  },
  "metadata": {
    "name": "test-heartbeat-watcher",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2021-04-24T00:01:20.068Z",
    "execution_duration": 8,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 11,
          "failed": 0,
          "successful": 11,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 10000,
          "max_score": null
        },
        "took": 7,
        "timed_out": false,
        "aggregations": {
          "heartbeat_count": {
            "value": 60480
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat-*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1d/d",
                        "lt": "now/d"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "heartbeat_count": {
                "value_count": {
                  "field": "_index"
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          "ctx.payload.aggregations.heartbeat_count.value": 60480
        }
      }
    },
    "actions": [
      {
        "id": "notify-slack",
        "type": "slack",
        "status": "simulated",
        "slack": {
          "message": {
            "from": "x-pack",
            "to": [
              "#stephenb-es-integration"
            ],
            "icon": "http://example.com/images/watcher-icon.jpg",
            "text": "test-heartbeat-watcher : Encountered 60480 heartbeats in the last 1 day"
          }
        }
      }
    ]
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:07pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/16 "2021-04-23T23:07:05Z")

</div>

> [@stephenb](#):
>
> `{{ctx.payload.aggregations.heartbeat_count}}`

```auto
{
  "watch_id": "_inlined_",
  "node": "ELuSGxpSRICZb2ZHJp4paA",
  "state": "execution_not_needed",
  "user": "elastic",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2021-04-23T23:06:36.178Z"
    },
    "last_checked": "2021-04-23T23:06:36.178Z",
    "actions": {
      "email_1": {
        "ack": {
          "timestamp": "2021-04-23T23:06:36.178Z",
          "state": "awaits_successful_execution"
        }
      }
    },
    "execution_state": "execution_not_needed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2021-04-23T23:06:36.178Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2021-04-23T23:06:36.178Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count": {
        "gte": 1000
      }
    }
  },
  "metadata": {
    "name": "Estado herramienta monitoreo",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2021-04-23T23:06:36.178Z",
    "execution_duration": 10,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 8,
          "failed": 0,
          "successful": 8,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 10000,
          "max_score": null
        },
        "took": 9,
        "timed_out": false,
        "aggregations": {
          "heartbeat_count": {
            "value": 82079
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1d/d",
                        "lt": "now/d"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "heartbeat_count": {
                "value_count": {
                  "field": "_index"
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": false,
      "compare": {
        "resolved_values": {
          "ctx.payload.aggregations.heartbeat_count": {
            "value": 82079
          }
        }
      }
    },
    "actions": []
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 11:21pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/17 "2021-04-23T23:21:46Z")

</div>

Yeah hmmm let me look at that something simple we are missing

> [@Juan\_David\_Jaramillo](#):
>
> ` "met": false,` \<!---- Hmmmmmm

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:24pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/18 "2021-04-23T23:24:18Z")

</div>

yes, so it does not run, because it says "OK" and not Firing so it appears "false", but it does not show me the metric in the mail so :{{ctx.payload.aggregations.heartbeat\_count}} does not work.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 11:27pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/19 "2021-04-23T23:27:56Z")

</div>

Let me figure this out... and get back.... mine works but the condition met it is the condition so the action is not executed. Then I will need to see your action.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:32pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/20 "2021-04-23T23:32:47Z")

</div>

see if I put {{ctx.payload.aggregations.heartbeat\_count.value}} instead of {{ctx.payload.aggregations.heartbeat\_count}} if it is executed and it goes to true, see

```auto
{
  "watch_id": "_inlined_",
  "node": "ELuSGxpSRICZb2ZHJp4paA",
  "state": "executed",
  "user": "elastic",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2021-04-23T23:32:06.342Z"
    },
    "last_checked": "2021-04-23T23:32:06.342Z",
    "last_met_condition": "2021-04-23T23:32:06.342Z",
    "actions": {
      "email_1": {
        "ack": {
          "timestamp": "2021-04-23T23:32:06.342Z",
          "state": "ackable"
        },
        "last_execution": {
          "timestamp": "2021-04-23T23:32:06.342Z",
          "successful": true
        },
        "last_successful_execution": {
          "timestamp": "2021-04-23T23:32:06.342Z",
          "successful": true
        }
      }
    },
    "execution_state": "executed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2021-04-23T23:32:06.342Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2021-04-23T23:32:06.342Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count.value": {
        "gte": 1000
      }
    }
  },
  "metadata": {
    "name": "Estado herramienta monitoreo",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2021-04-23T23:32:06.342Z",
    "execution_duration": 9,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 8,
          "failed": 0,
          "successful": 8,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 10000,
          "max_score": null
        },
        "took": 8,
        "timed_out": false,
        "aggregations": {
          "heartbeat_count": {
            "value": 82079
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1d/d",
                        "lt": "now/d"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "heartbeat_count": {
                "value_count": {
                  "field": "_index"
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          "ctx.payload.aggregations.heartbeat_count.value": 82079
        }
      }
    },
    "transform": {
      "type": "script",
      "status": "success",
      "payload": {
        "time_triggered": "2021-04-23 18:32:06"
      }
    },
    "actions": [
      {
        "id": "email_1",
        "type": "email",
        "status": "simulated",
        "email": {
          "message": {
            "id": "email_1 __inlined__ a4be7761-73f6-4c13-a6fc-68c4cecc0569-2021-04-23T23:32:06.342679Z_26878",
            "sent_date": "2021-04-23T23:32:06.352439Z",
            "to": [
              "victor.vera@megadvantage.com",
              "juan.jaramillo@megadvantage.com",
              "andres.molinac.pr@etb.com.co",
              "juan.ariasp1.pr@etb.com.co"
            ],
            "bcc": [
              "juancho.jaramillo16@gmail.com"
            ],
            "subject": "Estado herramienta monitoreo",
            "body": {
              "text": "Buen dia, \n\n ⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas \n \n \n \n \n \n Estado: UP🟢 \n\n 🕧Hora: 2021-04-23 18:32:06 \n\n Área: Networking \n \n🔔Mensaje Alerta: Por favor no responder a este mensaje \n\n "
            }
          }
        }
      }
    ]
  },
  "messages": []
}

```

source code:

```auto
"condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count.value": {
        "gte": 1000
      }
    }
  },

```

[Next page](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609.md?page=2)