# How to write trigger condition

**URL:** <https://forum.opensearch.org/t/how-to-write-trigger-condition/311>\
**Category:** Alerting\
**Tags:** troubleshoot\
**Created:** [March 29, 2019, 5:39am UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311 "2019-03-29T05:39:07Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yogesh](https://avatars.discourse-cdn.com/v4/letter/y/49beb7/32.png) [@Yogesh](https://forum.opensearch.org/u/Yogesh)\
**Post date:** [March 29, 2019, 5:39am UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/1 "2019-03-29T05:39:07Z")

</div>

I am writing trigger condition for user created and deleted within 10 mn. Below is condition , but it is giving  
compile error

{“script”:{ “lang”: “painless”,  
“source”: “def removes=ctx.payload.aggregations.event\_id.buckets.remove.users.buckets.stream().map(p → p.key).collect(Collectors.toList()); return ctx.payload.aggregations.event\_id.buckets.add.users.buckets.stream().map(p → p.key).filter(p → removes.contains(p)).toArray().length \> 0;”  
}}

---

<div class="post-metadata">

**Author:** ![dbbaughe](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dbbaughe](https://forum.opensearch.org/u/dbbaughe)\
**Post date:** [March 29, 2019, 11:22pm UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/2 "2019-03-29T23:22:43Z")

</div>

Hi Yogesh,

Please refer to:

> **[Monitors](https://opendistro.github.io/for-elasticsearch-docs/docs/alerting/monitors/#extraction-query)**
>
> Documentation for Open Distro, the community-driven, 100% open source distribution of Elasticsearch OSS with advanced security, alerting, deep performance analysis, and more.

The monitor query response should be accessed using **ctx.results[0]** instead of **ctx.payload**

Thanks,  
Drew

---

<div class="post-metadata">

**Author:** ![asikarwar](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/asikarwar/32/286_2.png) [@asikarwar](https://forum.opensearch.org/u/asikarwar)\
**Post date:** [September 13, 2019, 2:54pm UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/3 "2019-09-13T14:54:43Z")

</div>

Hi,

I want to write a condition where it will check count for each host and not total

So instead of this  
`ctx.results[0].hits.total.value > 400`  
I need to access **doc\_count**  
something like the following:  
`ctx.results[0].aggregations.group_by_host.buckets.doc_count > 400`

But the above throw error:

```auto
    {
      "type" : "script_exception",
      "reason" : "runtime error",
      "script_stack" : [
        "ctx.results[0].aggregations.group_by_host.buckets.doc_count > 400",
        " ^---- HERE"
      ],
      "script" : "ctx.results[0].aggregations.group_by_host.buckets.doc_count > 400",
      "lang" : "painless",
      "caused_by" : {
        "type" : "illegal_argument_exception",
        "reason" : "Illegal list shortcut value [doc_count]."
      }
    }

```

Following is the response from extraction query which i am using for trigger action how can i access **doc\_count** which i under **buckets** so it will only qualify

```auto
{
    "_shards": {
        "total": 198,
        "failed": 0,
        "successful": 198,
        "skipped": 52
    },
    "hits": {
        "hits": [],
        "total": {
            "value": 496,
            "relation": "eq"
        },
        "max_score": null
    },
    "took": 11,
    "timed_out": false,
    "aggregations": {
        "group_by_host": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
                {
                    "doc_count": 494,
                    "key": "Computer1"
                },
                {
                    "doc_count": 2,
                    "key": "Computer2"
                }
            ]
        },
        "event_count": {
            "value": 496
        } 
    }
}

```

---

<div class="post-metadata">

**Author:** ![cbanaszak](https://avatars.discourse-cdn.com/v4/letter/c/ea666f/32.png) [@cbanaszak](https://forum.opensearch.org/u/cbanaszak)\
**Post date:** [October 18, 2019, 3:33pm UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/4 "2019-10-18T15:33:02Z")

</div>

I’ve run into this issue and im still working it but I know that because the buckets are in an array like the results you have to include that array in your source like the [0] here referencing the first item in the array. What I am trying to figure out is how to match that against all buckets.

ctx.results[0].aggregations.group\_by\_host.buckets[0].doc\_count

---

<div class="post-metadata">

**Author:** ![lucaswin-amzn](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/lucaswin-amzn/32/192_2.png) [@lucaswin-amzn](https://forum.opensearch.org/u/lucaswin-amzn)\
**Post date:** [October 29, 2019, 4:43pm UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/5 "2019-10-29T16:43:18Z")

</div>

Hi @cbanaszak,

Am I understanding correctly that in your trigger condition you would like to loop over all values in `ctx.results[0].aggregations.group_by_host.buckets`? If so you can do this by using the `.size()` so something like:

```auto
for (int i = 0; i < ctx.results[0].aggregations.group_by_host.buckets.size(); i++) {
// bucket values can be accessed via: ctx.results[0].aggregations.group_by_host.buckets[i].doc_count
// for example.
}

```

---

<div class="post-metadata">

**Author:** ![bijeshr](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@bijeshr](https://forum.opensearch.org/u/bijeshr)\
**Post date:** [December 8, 2020, 1:18am UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/6 "2020-12-08T01:18:14Z")

</div>

buckets is an array, so something like this works:

```auto
ctx.results[0].aggregations.group_by_host.buckets[0].doc_count > 400

```

---

<div class="post-metadata">

**Author:** ![bilalcaliskan](https://avatars.discourse-cdn.com/v4/letter/b/edb3f5/32.png) [@bilalcaliskan](https://forum.opensearch.org/u/bilalcaliskan)\
**Post date:** [March 25, 2022, 10:51am UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/7 "2022-03-25T10:51:54Z")

</div>

i dont think that the real problem is solved here. problem is how to check if any buckets in the bucket list is triggers the condition. @lucaswin-amzn sadly your for loop does not work on Opendistro.

Creating a trigger based on the first bucket won’t be effective i think because i may have several buckets and maybe the last bucket exceeds the threshold.

---

<div class="post-metadata">

**Author:** ![divyank\_1](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@divyank\_1](https://forum.opensearch.org/u/divyank_1)\
**Post date:** [December 21, 2022, 1:03pm UTC](https://forum.opensearch.org/t/how-to-write-trigger-condition/311/8 "2022-12-21T13:03:56Z")

</div>

I tried writing the trigger condition in same format as suggested but getting error:

My monitor output:

```auto
{
    "_shards": {
        "total": 1,
        "failed": 0,
        "successful": 1,
        "skipped": 0
    },
    "hits": {
        "hits": [],
        "total": {
            "value": 23,
            "relation": "eq"
        },
        "max_score": null
    },
    "took": 26,
    "timed_out": false,
    "aggregations": {
        "data_aggs_interval": {
            "buckets": [
                {
                    "key_as_string": "2022-11-24T00:00:00.000Z",
                    "doc_count": 8,
                    "tag_names": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 2,
                        "buckets": [
                            {
                                "doc_count": 3,
                                "metrics": {
                                    "value": 3000
                                },
                                "key": "I_DRV155_CFB"
                            },
                            {
                                "doc_count": 3,
                                "metrics": {
                                    "value": 197
                                },
                                "key": "M_E2MDD_CFB"
                            }
                        ]
                    },
                    "key": 1669248000000
                },
                {
                    "key_as_string": "2022-12-04T00:00:00.000Z",
                    "doc_count": 15,
                    "tag_names": {
                        "doc_count_error_upper_bound": 0,
                        "sum_other_doc_count": 1,
                        "buckets": [
                            {
                                "doc_count": 10,
                                "metrics": {
                                    "value": 197
                                },
                                "key": "M_E2MDD_CFB"
                            },
                            {
                                "doc_count": 4,
                                "metrics": {
                                    "value": 197
                                },
                                "key": "I_RM3201_RTD_08"
                            }
                        ]
                    },
                    "key": 1670112000000
                }
            ]
        }
    }
}

```

If I try to access first bucket, the trigger condition is working:

First bucket trigger condition:

```auto
return ctx.results[0].aggregations.data_aggs_interval.buckets[0].tag_names.buckets[0].metrics.value == null ? false:
(ctx.results[0].aggregations.data_aggs_interval.buckets[0].tag_names.buckets[0].metrics.value >= 3000 && 
ctx.results[0].aggregations.data_aggs_interval.buckets[0].tag_names.buckets[0].key == "I_DRV155_CFB")

```

Using loops , it can be achieved as below.

For loop trigger condition:

```auto
int score = 0;
for (int i = 0; i < ctx.results[0].aggregations.data_aggs_interval.buckets.size(); i++) 
{
if (ctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].metrics.value == null ? false:
ctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].metrics.value >= 3000 && 
ctx.results[0].aggregations.data_aggs_interval.buckets[i].tag_names.buckets[i].key == "I_DRV155_CFB")
{
    score += 10;
  } 
}
if (score > 0) {
  return true;
} else {
  return false;
}

```