# Watcher with foreach and aggregation

**URL:** <https://discuss.elastic.co/t/watcher-with-foreach-and-aggregation/214579>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 10, 2020, 9:51am UTC](https://discuss.elastic.co/t/watcher-with-foreach-and-aggregation/214579 "2020-01-10T09:51:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![HansPeterSloot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanspetersloot/32/51132_2.png) [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)\
**Post date:** [January 10, 2020, 9:51am UTC](https://discuss.elastic.co/t/watcher-with-foreach-and-aggregation/214579/1 "2020-01-10T09:51:20Z")

</div>

Hi,  
I have a watcher with an aggregation query.  
The result of the aggregation is e.g:  
"min\_docs" : {  
"value" : 17.0,  
"keys" : ["CID1","CID2"]  
}

I have defined the watcher condition and action defined as:  
"condition": {  
"compare": {  
"ctx.payload.aggregations.min\_docs.value": {  
"lt": 100  
}  
}  
},  
"actions": {  
"my-logging-action": {  
"foreach": "ctx.payload.aggregations.min\_docs.keys",  
"max\_iterations": 100,  
"logging": {  
"level": "info",  
"text": "There are nodes with 100 documents in the last 15 minutes."  
}  
}  
}

I want to have the key CID1 in the text for the first iteration and CID2 for the second iteration.

What is the correct way?

Regards Hans

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 10, 2020, 2:24pm UTC](https://discuss.elastic.co/t/watcher-with-foreach-and-aggregation/214579/2 "2020-01-10T14:24:42Z")

</div>

Hey,

try this

```auto
POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "10h"
      }
    },
    "input": {
      "simple": {
        "foo": ["1", "2", "3"]
      }
    },
    "actions": {
      "logme": {
        "foreach" : "ctx.payload.foo",
        "logging": {
          "text": "Test {{ctx.payload._value}}"
        }
      }
    }
  }
}

```

As you can see, the values of the array (if they are single valued) are available in `ctx.payload._value`, otherwise `ctx.payload` is a map or an array.

Hope that helps.

P.S. It'd be great, if you could format your snippets, as it makes them much easier to read. This forums supports markdown, so snippets are almost easy as cake 🙂

---

<div class="post-metadata">

**Author:** ![HansPeterSloot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanspetersloot/32/51132_2.png) [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)\
**Post date:** [January 10, 2020, 5:17pm UTC](https://discuss.elastic.co/t/watcher-with-foreach-and-aggregation/214579/3 "2020-01-10T17:17:57Z")

</div>

Thanks!  
Sorry for the formatting.  
Is a no-brainer.

---

<div class="post-metadata">

**Author:** ![HansPeterSloot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hanspetersloot/32/51132_2.png) [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)\
**Post date:** [January 13, 2020, 1:42pm UTC](https://discuss.elastic.co/t/watcher-with-foreach-and-aggregation/214579/4 "2020-01-13T13:42:52Z")

</div>

Hi,

Can I access ctx.payload.aggregations.min\_docs.value form the condition also in the text?

```
"condition": {
"compare": {
  "ctx.payload.aggregations.min_docs.value": {
    "lt": 100
  }
}
  },
 "actions": {
"my-logging-action": {
  "foreach": "ctx.payload.aggregations.min_docs.keys",
  "max_iterations": 100,
  "logging": {
    "level": "info",
    "text": "There are hosts with 0 documents in the last 15 minutes. {{#ctx.payload}}{{ctx.payload._value}}{{/ctx.payload}}"
  }
 }

```

}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 13, 2020, 2:03pm UTC](https://discuss.elastic.co/t/watcher-with-foreach-and-aggregation/214579/5 "2020-01-13T14:03:46Z")

</div>

hey,

there is no support for this out of the box to access the original payload. What you could to in a workaround, is to have a [script transform](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/transform-script.html), that puts the `.value` field into each element of the `.keys` field and thus it is accessible in the mustache payload.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 10, 2020, 2:03pm UTC](https://discuss.elastic.co/t/watcher-with-foreach-and-aggregation/214579/6 "2020-02-10T14:03:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.