how to send email alert to groups based on condition success in kibana watcher action

Question

I am able to categorize various error like this ---

But i want to send email to groups based on error message.

Something like ---

when error ie "key"= "Response status code does not indicate success Service Unavailable" ---send email to group 1 [user1@gmail.com,user2@gmail.com,user3@gmail.com]

when error ie "key"= "Response status code does not indicate success Gateway" ---send email to group 2 [user4@gmail.com,user5@gmail.com,user6@gmail.com]

I have done upto this much ---

  "actions": {
"send_email": {
  "throttle_period_in_millis": 300000,
  "condition": {
    "script": {
      "source": " def status = false; for(int i=0; i<ctx.payload.failure_request.aggregations.categories.buckets.length;i++) {if(ctx.payload.failure_request.aggregations.categories.buckets[i].key.contains('Response status code does not indicate success')) {status = true}} return status ",
      "lang": "painless"
    }
  },
  "email": {
    "profile": "standard",
    "to": [
      "avinash.singh1@spglobal.com"
    ],
    "subject": "{{ctx.metadata.email_subject}}",
    "body": {
      "html": "Error Found: <ul> {{ctx.payload.aggregations.categories.buckets.length}}"
                   }
                 }
              }
            }

Even Email is going to the given email when condition is pass ie when key contains that message. But I want to send email based on message match for specific group at one go.

can any one help me on this if we have something in painless language to write logic like case statement.

Appreciate your help in advance.

This question is on kibana watcher action . – Avinash Singh Jun 10 '22 at 18:09 — Avinash Singh, Jun 10 '22 at 18:09

Paco BADIANE · Accepted Answer · 2022-07-01T08:22:19.493

These is my advice, I hope that can help you.

solution one: match with a string

"actions": {
    "email_group_one" : {
        "condition": {
            "script": {
                "source": "def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key == 'Response status code does not indicate success Service Unavailable');"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["user1@gmail.com","user2@gmail.com","user3@gmail.com"],
            "subject" : "YOUR SUBJEC",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    },
    "email_group_two" : {
        "condition": {
            "script": {
                "source": "def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key == 'Response status code does not indicate success Gateway');"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["user4@gmail.com","user5@gmail.com","user5@gmail.com"],
            "subject" : "YOUR SUBJECT",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    }

}

solution two: match with multiple values like a,b,c and d

"actions": {
    "email_group_one" : {
        "condition": {
            "script": {
                "source": "def myArray= ['a', 'b', 'c', 'd'];def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key in myArray);"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["user1@gmail.com","user2@gmail.com","user3@gmail.com"],
            "subject" : "YOUR SUBJEC",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    },
    "email_group_two" : {
        "condition": {
            "script": {
                "source": "def myArray= ['e', 'f', 'g', 'h'];def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key in myArray);"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["user4@gmail.com","user5@gmail.com","user5@gmail.com"],
            "subject" : "YOUR SUBJECT",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    }

}

the code has not been tested, you may have syntax errors.

Badine - The format is same and it is working fine. I created 3 groups and added different mails. All are getting mail according to error encountered. — Avinash Singh, Jun 13 '22 at 13:21
"text": """Encountered:{ctx.payload.failure_request.aggregations.categories.buckets.length} in the last hour on {ctx.payload.failure_request.aggregations.categories.buckets[i].key} Files: {ctx.payload.failure_request.aggregations.categories.buckets[i].key}: {ctx.payload.failure_request.aggregations.categories.buckets[i].doc_count} """ I wanted to show how many doc count encountered , The message , the stack trace etc. I included above code but it is not taking. May be it is having some mistake in grabing each bucket. — Avinash Singh, Jun 13 '22 at 13:22
if you want to get the number of doc_count, you must add a "transforms" block to transform the buckets. — Paco BADIANE, Jun 13 '22 at 18:12
It is working as expected now after changing the script in mustache format. I am getting another problem. How i can write multiple error in contain keyword ?? ctx.payload.failure_request.aggregations.categories.buckets[i].key.contains('Response status code does not indicate success'). Here I want to include some more errors like - .key.contain('a','b','c','d') . anyone know about this?? — Avinash Singh, Jun 30 '22 at 18:27
I update my response. Look at the "solution two" it answer you request — Paco BADIANE, Jul 01 '22 at 08:24

how to send email alert to groups based on condition success in kibana watcher action

1 Answers1