# Watchers Offenders limited to 10?
**URL:** https://discuss.elastic.co/t/watchers-offenders-limited-to-10/184772
**Category:** Kibana
**Created:** [June 7, 2019, 1:59pm UTC](https://discuss.elastic.co/t/watchers-offenders-limited-to-10/184772 "2019-06-07T13:59:32Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)
#### Post date: [June 7, 2019, 1:59pm UTC](https://discuss.elastic.co/t/watchers-offenders-limited-to-10/184772/1 "2019-06-07T13:59:32Z")
Hi all,
I have written a watcher that grabs all the host\_ids that have sent logs in the past 5minutes. and sends them to a webhook.
I can see from doing a query in Kibana that there are ~20 or so in a 5minute period.
However, when the watcher sends the webhook it is only sending the top 10 ids, obviously this is capped somewhere to be the top 10.
Any ideas how to adapt my watcher so that it sends ALL the device\_ids? Is it a setting inside here, or a global setting like the size on the aggregation setting?
Bear in mind that this number could reach 10000+ in the future.
```
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"tid.*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-{{ctx.metadata.window_period}}"
}
}
},
{
"exists": {
"field": "device_id"
}
}
]
}
},
"aggs": {
"device_id": {
"terms": {
"field": "device_id"
},
"aggs": {
"events": {
"top_hits": {
"size": 1,
"_source": [
"device_id"
]
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
"source": """
def offenders = [];
for (def device_id: ctx.payload.aggregations.device_id.buckets) {
if (device_id.doc_count >= 1) {
offenders.add([
'device_id': device_id.key,
'execution_time' : ctx.trigger.triggered_time
]);
}
}
ctx.payload.offenders = offenders;
return offenders.size() > 0;""",
"lang": "painless"
}
},
"actions": { Webook here }
},
"body": "{{#toJson}}ctx.payload.offenders{{/toJson}}"
}
}
},
"metadata": {
"window_period": "5m"
},
"throttle_period_in_millis": 120000
}
```
---
### Author:  [@Aaron\_Caldwell](https://discuss.elastic.co/u/Aaron_Caldwell)
#### Post date: [June 7, 2019, 4:11pm UTC](https://discuss.elastic.co/t/watchers-offenders-limited-to-10/184772/2 "2019-06-07T16:11:28Z")
Hello Jason,
I think you'd want to add a [size parameter](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html#search-aggregations-bucket-terms-aggregation-size) to your aggregation (it defaults to 10). You can modify it using the [advanced watch editor](https://www.elastic.co/guide/en/kibana/current/watcher-create-advanced-watch.html).
Regards,
Aaron
---
### Author:  [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)
#### Post date: [June 10, 2019, 9:00am UTC](https://discuss.elastic.co/t/watchers-offenders-limited-to-10/184772/3 "2019-06-10T09:00:01Z")
Hi Aaron!
Thank you, I had the "size" on the wrong aggregation.
Is there a limit to the size that you know of?
Jason
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 8, 2019, 9:00am UTC](https://discuss.elastic.co/t/watchers-offenders-limited-to-10/184772/4 "2019-07-08T09:00:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.