7.12 Kibana log alerting - pass log details to PagerDuty

[tslattery (Terry Slattery)]

7.12 Kibana alerting
I am trying to get some details of a log message to propagate to PagerDuty. The Connector is working and events are created in PD. The alert configuration:

I read these two threads and understand that there may be multiple values of a field if the alert is the aggregation of multiple documents.

Custom variables in Kibana Alerts

I am exploring alerts and connectors in Kibana. I can configure and test them perfectly but I am unable to use the custom variable present in metricbeat, filebeat or any other beat module index. Let me explain this by an example. Let say, two different snapshot of my application is running on different servers with metricbeat docker module enabled. The hostname of my first server is host1 and second is host2. The container name of the application is myapp. I've one variable serviceName which is…

The context.thresholdOf, context.metricOf and context.valueOf not working in inventory alert

Hi, I am using the ELK 7.8.0 and making an inventory alert. I have created an action message as shown below. [image] But I am not getting values for context.thresholdOf, context.metricOf and context.valueOf. I have also tried context.reason as well but not worked. When I checked the alert index I found the following. [image] I want to get the current values for CPU and RAM utilization. Please help, if I am making any mistake or anything else.

There is no aggregation in this case. I'd like to pass the values of several fields to PD, such as the device MAC, serialNumber, domainName, zoneName.

Thanks!

[Igor_Zaytsev]

I think this is only possible with a preconfigured pager duty connecter. And, also with enabled attach_payload in your elasticsearch.yml

[tslattery (Terry Slattery)]

Is there more detailed documentation on creating a preconfigured PD connector and attaching a payload? I'm not following the docs in the links you provided.
Thanks!

[Patrick_Mueller (Patrick Mueller (Kibana Alerting))]

We have an issue open to make more of the data from the searched documents available in actions - [Discuss] Ability to interact with the alert query result - User requests · Issue #89161 · elastic/kibana · GitHub