New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Actions Adding conditions to actions »
Elastic Docs ›Elasticsearch Guide [7.3] ›Alerting on cluster and index events ›Actions

Running an action for each element in an array

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Running an action for each element in an array

edit

You can use the foreach field in an action to trigger the configured action for every element within that array.

In order to protect from long running watches, after one hundred runs with an foreach loop the execution is gracefully stopped.

PUT _watcher/watch/log_event_watch
{
  "trigger" : {
    "schedule" : { "interval" : "5m" }
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : "log-events",
        "body" : {
          "query" : { "match" : { "status" : "error" } }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 } }
  },
  "actions" : {
    "log_hits" : {
      "foreach" : "ctx.payload.hits.hits", 
      "logging" : {
        "text" : "Found id {{ctx.payload._id}} with field {{ctx.payload._source.my_field}}"
      }
    }
  }
}
Copy as curlTry in Elastic 

The logging statement will be executed for each of the returned search hits.
« Actions Adding conditions to actions »
Was this helpful?
Feedback