Watch with simple terms agg and threshold

simple_terms_agg_threshold.txt

POST _watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "5m"
      }
    },
    "input": {
      "search": {
        "request": {
          "indices": [
            "farequote"
          ],
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-5y"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "airlines": {
                "terms": {
                  "field": "airline",
                  "size": 20
                },
                "aggs": {
                  "max_responsetime": {
                    "max": {
                      "field": "responsetime"
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "script": """

        return ctx.payload.aggregations.airlines.buckets.stream()       
          .filter(airlines -> airlines.max_responsetime.value > 3000)               
          .count() > 0 
        """
    },
    "actions": {
      "log": {
        "transform": {
          "script": """
        return ctx.payload.aggregations.airlines.buckets.stream()       
          .filter(airlines -> airlines.max_responsetime.value > 3000)               
          .collect(Collectors.toList());
          """
        },
        "logging": {
          "text": """
		{{#ctx.payload._value}}
		airline={{key}} exceeded 3sec threshold with responsetime={{max_responsetime.value}}
		{{/ctx.payload._value}}
		"""
        }
      }
    }
  }
}