# Watcher that counts the documents that arrive to an index in kibana

**URL:** <https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 19, 2021, 4:45pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609 "2021-04-19T16:45:55Z")\
**Posts on this page:** 7\
**Page:** 3

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 24, 2021, 12:30am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/41 "2021-04-24T00:30:11Z")

</div>

what those?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 24, 2021, 12:37am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/42 "2021-04-24T00:37:22Z")

</div>

Sorry it means once we know the Magic Incantation... sometime we say that when we need to just know the exact syntax ... its kinda a joke / frustration about knowing the exact syntax ... and close does not work.

And here you go...

When you create that time variable it is part of `ctx.payload`

NOTE / EDIT this does not work as it writes over a payload.

```
  "actions": {
    "notify-slack": {
      "slack": {
        "message": {
          "to": [
            "#stephenb-es-integration"
          ],
          "text": "{{ctx.payload.time}} {{ctx.metadata.name}} : Encountered {{ctx.payload.aggregations.heartbeat_count.value}} heartbeats in the last 1 day"
        }
      }
    }
  },

  "transform" : {
    "script" : "return ['time' : ctx.trigger.triggered_time.withZoneSameInstant(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))]" 
  }
}

```

**NOTE I just changed to `triggered_time` since that is probable more accurate**

output

> APP [5:36 PM]  
> 2021-04-23 19:36:28 test-heartbeat-watcher : Encountered heartbeats in the last 1 day

**Ohh I just noticed that broke the payload again that must be what is happening!**

**Let me fix!!!**

Ahhh I see it right [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.12/transform-script.html)

A [payload transform](https://www.elastic.co/guide/en/elasticsearch/reference/7.12/transform.html) that executes a script on the current payload in the watch execution context and replaces it with a newly generated one. The following snippet shows how a simple script payload transform can be defined on the watch level:

A simple painless script **that creates a new payload** with a single time field holding the scheduled time.

So it is writing over our payload!!!

I will need to research ... I am sure it is simple...

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 24, 2021, 12:59am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/43 "2021-04-24T00:59:07Z")

</div>

ok, I hope it can be done

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 24, 2021, 12:59am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/44 "2021-04-24T00:59:36Z")

</div>

i'll figure it out but may not be tonight

And full circle... this may have been easier with kibana alerts 🙂

After I figure this out I will do that

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 24, 2021, 1:40am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/45 "2021-04-24T01:40:42Z")

</div>

@Juan_David_Jaramillo

And here you go 🙂

The Trick or (_Magic Incantation_) is that since the transform creates a _new_ payload that overwrites the existing one, you need to save into the new payload the fields you want to use from the old payload ... and then reference them directly.

Note since I renamed / copied in the `heartbeat_count.value` into the new payload it is now at the top level of the new `ctx.payload` object

```
  "actions": {
    "notify-slack": {
      "slack": {
        "message": {
          "to": [
            "#stephenb-es-integration"
          ],
          "text": "{{ctx.metadata.name}} executed at {{ctx.payload.local_execution_time}} : Encountered {{ctx.payload.heartbeat_count}} heartbeats in the last 1 day"
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": """
        return [
        'local_execution_time' : ctx.trigger.triggered_time.withZoneSameInstant(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss')),
        'heartbeat_count' : ctx.payload.aggregations.heartbeat_count.value
          ]
      """,
      "lang": "painless"
    }
  }
}

```

And the results ...

> test-heartbeat-watcher executed at 2021-04-23 20:44:46 : Encountered 60480 heartbeats in the last 1 day
> 
> test-heartbeat-watcher executed at 2021-04-23 20:45:01 : Encountered 60480 heartbeats in the last 1 day

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 24, 2021, 2:06am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/46 "2021-04-24T02:06:21Z")

</div>

> [@stephenb](#):
>
> `{{ctx.payload.heartbeat_count}}`

Very Thanks!!! Amazing! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2021, 2:06am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/47 "2021-05-22T02:06:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609.md?page=2)