# Watcher - Write painless script for looping aggregated buckets

**URL:** <https://discuss.elastic.co/t/watcher-write-painless-script-for-looping-aggregated-buckets/321763>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting, painless\
**Created:** [December 21, 2022, 12:36pm UTC](https://discuss.elastic.co/t/watcher-write-painless-script-for-looping-aggregated-buckets/321763 "2022-12-21T12:36:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Divyank\_Mahalle](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divyank_mahalle/32/91240_2.png) [@Divyank\_Mahalle](https://discuss.elastic.co/u/Divyank_Mahalle)\
**Post date:** [December 21, 2022, 12:36pm UTC](https://discuss.elastic.co/t/watcher-write-painless-script-for-looping-aggregated-buckets/321763/1 "2022-12-21T12:36:39Z")

</div>

Hi,

My Watcher condition is giving output as below:

Watcher condition Output:

```auto
{
    "_shards": {
        "total": 1,
        "failed": 0,
        "successful": 1,
        "skipped": 0
    },
    "hits": {
        "hits": [],
        "total": {
            "value": 23,
            "relation": "eq"
        },
        "max_score": null
    },
    "took": 26,
    "timed_out": false,
    "aggregations": {
        "data_aggs_interval": {
            "buckets": [
                {
                    "key_as_string": "2022-11-24T00:00:00.000Z",
                    "doc_count": 8,
                    "tag_names": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 2,
                        "buckets": [
                            {
                                "doc_count": 3,
                                "metrics": {
                                    "value": 3000
                                },
                                "key": "I_DRV155_CFB"
                            },
                            {
                                "doc_count": 3,
                                "metrics": {
                                    "value": 197
                                },
                                "key": "M_E2MDD_CFB"
                            }
                        ]
                    },
                    "key": 1669248000000
                },
                {
                    "key_as_string": "2022-12-04T00:00:00.000Z",
                    "doc_count": 15,
                    "tag_names": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 1,
                        "buckets": [
                            {
                                "doc_count": 10,
                                "metrics": {
                                    "value": 197
                                },
                                "key": "M_E2MDD_CFB"
                            },
                            {
                                "doc_count": 4,
                                "metrics": {
                                    "value": 197
                                },
                                "key": "I_RM3201_RTD_08"
                            }
                        ]
                    },
                    "key": 1670112000000
                }
            ]
        }
    }
}

```

I want to write a trigger condition, to trigger an alert when each bucket contains "key" : `I_DRV155_CFB` and "value" \> "200".

Below is my trigger condition, I am able to build condition to check only 1 bucket which is `bucket[0]`, I tried writing trigger condition to check for all buckets using `for` loop, but no luck.

Current working trigger condition which is accessing single bucket:

```auto
return ctx.results[0].aggregations.data_aggs_interval.buckets[0].tag_names.buckets[0].metrics.value == null ? false:
(ctx.results[0].aggregations.data_aggs_interval.buckets[0].tag_names.buckets[0].metrics.value >= 3000 && 
ctx.results[0].aggregations.data_aggs_interval.buckets[0].tag_names.buckets[0].key == "I_DRV155_CFB")

```

Let me how to implement trigger condition on all buckets.

I tried it using for loop but getting error:

```auto
for (int i = 0; i < ctx.results[0].aggregations.data_aggs_interval.buckets.size(); i++) 
{
return ctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].metrics.value == null ? false:
(ctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].metrics.value >= 3000 && 
ctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].key == "I_DRV155_CFB")
}

```

Error:

```auto
{
  "type" : "script_exception",
  "reason" : "compile error",
  "script_stack" : [
    "for (int i = 0; i < ctx.r ...",
    "^---- HERE"
  ],
  "script" : "for (int i = 0; i < ctx.results[0].aggregations.data_aggs_interval.buckets.size(); i++) \n{\nreturn ctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].metrics.value == null ? false:\n(ctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].metrics.value >= 3000 && \nctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].key == \"I_DRV155_CFB\")\n}",
  "lang" : "painless",
  "position" : {
    "offset" : 0,
    "start" : 0,
    "end" : 25
  },
  "caused_by" : {
    "type" : "illegal_argument_exception",
    "reason" : "extraneous for loop"
  }
}

```

Ref link: [ElasticSearch Watcher Painless script : illegal\_argument\_exception, reson: Extraneous for loop - Elasticsearch - Discuss the Elastic Stack](https://discuss.elastic.co/t/elasticsearch-watcher-painless-script-illegal-argument-exception-reson-extraneous-for-loop/153508)

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 21, 2022, 2:56pm UTC](https://discuss.elastic.co/t/watcher-write-painless-script-for-looping-aggregated-buckets/321763/2 "2022-12-21T14:56:19Z")

</div>

So, you need two (nested) loops, the first to iterate over the `data_aggs_interval.buckets` and then within that, iterate over the `tag_names.buckets`. Something like this:

```auto
    "condition": {
      "script": """
        for (def interval : ctx.payload.aggregations.data_aggs_interval.buckets) {
            for (def tag : interval.tag_names.buckets) {
                if (tag.key == "I_DRV155_CFB" && tag.avg_resp.value >= 3000) {
                  return true;
                }
          }
        }
        """
    },

```

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 21, 2022, 3:01pm UTC](https://discuss.elastic.co/t/watcher-write-painless-script-for-looping-aggregated-buckets/321763/3 "2022-12-21T15:01:10Z")

</div>

Ful working example using demo data: [alert\_on\_entity\_in\_an\_interval.txt · GitHub](https://gist.github.com/richcollier/eeb6d6f98599ac77fea69a684debe647)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2023, 3:01pm UTC](https://discuss.elastic.co/t/watcher-write-painless-script-for-looping-aggregated-buckets/321763/4 "2023-01-18T15:01:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.