Alert once if URL goes down or comes back up

Hi,

I have setup heartbeat and monitoring URLs.

I need help setting up when the URL goes down, I want to send only 1 email with the body of "URL goes down".

If any of the URL comes back up, I want to send only 1 email with the body of "The URL is back up".

I have set up for the down alert which works for me. But I need to set up for the up alert. I have used the throttle period field to repeat the alert for next trigger. But I cannot use the same way in up alert configuration.

Can someone please assist? I have tried and looked everywhere, cannot find correct configuration.

Down alert Config:

{
  "trigger": {
    "schedule": {
      "interval": "10m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "_source": [
            "monitor.id",
            "url.full",
            "summary.down",
            "lacode",
            "monitor.name"
          ],
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "summary.down": 1
                  }
                },
                {
                  "terms": {
                    "lacode": [
                      "LA001697"
                    ]
                  }
                }
              ],
              "filter": [
                {
                  "term": {
                    "monitor.type": "http"
                  }
                },
                {
                  "term": {
                    "summary.down": 1
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-30m"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "monitorId": {
              "terms": {
                "field": "monitor.id",
                "size": 10000
              },
              "aggs": {
                "types_count": {
                  "value_count": {
                    "field": "monitor.id"
                  }
                },
                "lacode_bucket_filter": {
                  "bucket_selector": {
                    "buckets_path": {
                      "valueCount": "types_count"
                    },
                    "script": "params.valueCount > 3"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "return ctx.payload.aggregations.monitorId.buckets.size() > 0",
      "lang": "painless"
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "to": [
          "nandhiniravisankar1999@gmail.com"
        ],
        "subject": "URLs are down and their code {{ctx.payload._value.2}}, {{ctx.payload._value.3}}",
        "body": {
          "html": "The number of URLs are down: {{ctx.payload._value.1}} <br><br>{{ctx.payload._value.0}}"
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": """
      
      Set set = ctx.payload.aggregations.monitorId.buckets.stream().map( it -> it.key).collect(Collectors.toSet());
      
    return [
      
      
      String.join("<br /> ",ctx.payload.hits.hits.stream()
      .filter( k -> set.contains( k._source.monitor.id))
      .map(p ->  p._source.url.full)
      .collect(Collectors.toSet()))
    
      ,
      set.size(),

       String.join("<br /> ",ctx.payload.hits.hits.stream()
      .filter( k -> set.contains( k._source.monitor.id))
      .map(p ->  p._source.lacode)
      .collect(Collectors.toSet())),
      
       String.join("<br /> ",ctx.payload.hits.hits.stream()
      .filter( k -> set.contains( k._source.monitor.id))
      .map(p ->  p._source.monitor.name)
      .collect(Collectors.toSet()))
      ]
    """,
      "lang": "painless"
    }
  },
  "throttle_period_in_millis": 54000000
}

Please suggest some solution for this.

Thank you!!

Hello @nandhini_r ,

You can add recovered action connector in the same connector. Once alert is resolved like in this case when url has recovered. it will send recovery alert.

Notice Recovered option in UI. You need to aslo add that beside adding Uptime Down monitor action.

Hi @shahzad31,

Thanks for your suggestion!!

Tried that too, I have test the connector but there was an error in sending email. Getting as authentication unsuccessful. But I have given the correct username and password only.
Connector

Hello @nandhini_r , Apologies for losing track of this.

Let me tag someone from alerting team, if they can help with figuring out the issue while creating a connector cc @Patrick_Mueller @mikecote . can you please help here.

Regards

The original question seemed to be asking about Watcher, and then the subsequent posts seem to be talking about Kibana Alerting, which are two completely separate things.

The message regarding the email looks like it came from Kibana alerting though.

  • try re-entering your userid / password, perhaps it was incorrect, or was cleared out last time the connector was edited (we require secrets like this to be re-entered when the connector is edited)
  • can you post a picture of your connector while you're editing it?
  • check with your mail provider to see if they have a certain set of SMTP endpoints they support; sometimes ports are left open, but require different authentication protocols
  • do you know what type of mail server is running at exchangelabs.com? Could this be gmail (which usually requires a different password scheme) or MS exchange (which might require you to go through OAuth)
1 Like

This topic was automatically closed 24 days after the last reply. New replies are no longer allowed.