1

I have a slack action configured. All aspects appear to be set up correctly. If I go to my watch's simulate section and choose execute (not ignoring the conditions) it executes fine and the message appears correctly templated in slack. If I save the config and let the watcher run it doesn't send. If I use the email action, it sends the email. If I use both, it sends neither.

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "elastic"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "must": {
                "match": {
                  "level": "ERROR"
                }
              },
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "now-1500m"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "notify-slack": {
      "throttle_period_in_millis": 5000,
      "slack": {
        "account": "monitoring",
        "proxy": {
          "host": "proxy.example.com"
          "port": 3128
        },
        "message": {
          "from": "watcher",
          "to": [
            "#elk-cluster-alerts"
          ],
          "text": "Elk Error Alerts",
          "icon": ":chuck:",
          "attachments": [
            {
              "color": "danger",
              "title": "Elk Error Alerts",
              "text": "Roundhouse kick!"
            }
          ]
        }
      }
    }
  }
}

UPDATE:

Not a fix, but the configuration works when I use a webhook instead of the slack config

Brandon Kauffman
  • 1,515
  • 1
  • 7
  • 33

0 Answers0