How to write trigger condition

[bijeshr]

buckets is an array, so something like this works:

ctx.results[0].aggregations.group_by_host.buckets[0].doc_count > 400