# Access Nested Objects using Painless for Alerting to Create Trigger Condition

**URL:** <https://forum.opensearch.org/t/access-nested-objects-using-painless-for-alerting-to-create-trigger-condition/10117>\
**Category:** Alerting\
**Created:** [June 29, 2022, 3:53pm UTC](https://forum.opensearch.org/t/access-nested-objects-using-painless-for-alerting-to-create-trigger-condition/10117 "2022-06-29T15:53:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![divyank\_1](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@divyank\_1](https://forum.opensearch.org/u/divyank_1)\
**Post date:** [June 29, 2022, 3:53pm UTC](https://forum.opensearch.org/t/access-nested-objects-using-painless-for-alerting-to-create-trigger-condition/10117/1 "2022-06-29T15:53:58Z")

</div>

I am to create Trigger condition in Monitor in Opensearch.I was trying to extract fields present in `_source` which is giving error `"reason" : "Illegal list shortcut value [_source]."`.

DSL Extraction Query-

```auto
{
    "size": 1,
    "sort": {"Date" : "desc" },
    "query": {
        "bool": {
            "filter": [
                {
                    "range": {
                        "Date": {
                            "from": "{{period_end}}||-3d",
                            "to": "{{period_end}}",
                            "include_lower": true,
                            "include_upper": true,
                            "format": "epoch_millis",
                            "boost": 1
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    },
    "aggregations": {
        "metric": {
            "avg": {
                "field": "difference"
            }
        }
    }
}

```

Output-

```auto
{
    "_shards": {
        "total": 4,
        "failed": 0,
        "successful": 4,
        "skipped": 2
    },
    "hits": {
        "hits": [
            {
                "_index": "reliance_cal_spread",
                "_source": {
                    "symbol": "RELIANCE",
                    "std_dev": 2.4,
                    "upper_range": 10.3,
                    "current_month_close": 2536.3,
                    "mean": 7.9,
                    "weekday": "Tuesday",
                    "difference": 3,
                    "Date": "2022-06-28T00:00:00",
                    "next_month_close": 2539.3,
                    "lower_range": 5.5
                },
                "_id": "E2-cqoEB0vMP3J-sGCIB",
                "sort": [
                    1656374400000
                ],
                "_score": null
            }
        ],
        "total": {
            "value": 2,
            "relation": "eq"
        },
        "max_score": null
    },
    "took": 8,
    "timed_out": false,
    "aggregations": {
        "metric": {
            "value": 2.799999952316284
        }
    }
}

```

Trigger Condition-

```auto
return ctx.results[0].aggregations.metric.value == null ? false :ctx.results[0].hits.hits._source.difference > 6

```

Error-

```auto
{
  "type" : "script_exception",
  "reason" : "runtime error",
  "script_stack" : [
    "return ctx.results[0].aggregations.metric.value == null ? false :ctx.results[0].hits.hits._source.difference > 6",
    " ^---- HERE"
  ],
  "script" : "return ctx.results[0].aggregations.metric.value == null ? false :ctx.results[0].hits.hits._source.difference > 6",
  "lang" : "painless",
  "position" : {
    "offset" : 89,
    "start" : 0,
    "end" : 112
  },
  "caused_by" : {
    "type" : "illegal_argument_exception",
    "reason" : "Illegal list shortcut value [_source]."
  }
}

```

While I am able to extract other conditions such as-`aggregations.metric.value` and `hits.total.value`.

Trigger Condition

```auto
return ctx.results[0].aggregations.metric.value == null ? false :ctx.results[0].aggregations.metric.value < 6

```

Trigger Condition Response-

```auto
True

```

---

<div class="post-metadata">

**Author:** ![divyank\_1](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@divyank\_1](https://forum.opensearch.org/u/divyank_1)\
**Post date:** [December 15, 2022, 8:40am UTC](https://forum.opensearch.org/t/access-nested-objects-using-painless-for-alerting-to-create-trigger-condition/10117/2 "2022-12-15T08:40:41Z")

</div>

Ref Link: [How to write trigger condition - #6 by bijeshr](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/6)

Triigger condition:

```auto
return ctx.results[0].aggregations.tag_names.buckets[0].metrics.max > 185

OUTPUT:
True

```