Alert Rule Triggered but No Data in Webhook Payload or Email Notification

Elastic Search
1

Title:
Alert Rule Triggered but No Data in Webhook Payload or Email Notification

Hi Elastic team,

I'm currently working with Kibana 9.0.3 in Elastic Cloud and running into a problem where my alerting rule seems to detect events properly, but no meaningful data is being sent to the configured Webhook or Email connectors.

:wrench: Setup Details:
Elasticsearch version: 9.0.3 (Elastic Cloud)

Kibana Rule Type: Elasticsearch Query

Query:
eventid: "cowrie.login.failed"

The query matches documents correctly in Discover — verified by searching and seeing real login failure events, including fields like src_ip, username, message, etc.

:white_check_mark: What Works:
I have created a Webhook connector pointing to Webhook.site, which works with test payloads.

Test payloads like:

{
"debug": "TEST1"
}
successfully appear in the Webhook logs.

Email notifications also work using the test button.

:cross_mark: What Doesn’t Work:
When the alert rule runs and triggers based on the simulated attack:

The Webhook payload contains only {"debug": ""} or an empty string, even though matching events exist.

The same happens with email templates using {{context.results}} — they come through blank or empty.

Even using {{{JSON.stringify context}}} shows {} as the output.

:package: Webhook Body (Action):

{
"debug": "{{{JSON.stringify context.results}}}"
}
Also tried:

{
"debug": "{{{JSON.stringify context}}}"
}
Still results in an empty payload.

:scroll: Alert Rule Settings:
Rule Type: Elasticsearch query

Schedule: Every 1 minute

Alert after: 1 consecutive match

Flapping detection: ON

The rule is enabled and running

The Preview Results button shows hits successfully

:clipboard: Observations:
The documents clearly match the query — and contain the data I want (e.g. src_ip, username, etc.)

But context.results appears to be empty or inaccessible when the rule triggers the action.

Test actions (manual) work fine. It’s the real execution that fails to populate data.

:red_question_mark:What I Need Help With:
Why is context.results empty when the rule is triggered, even though hits are detected?

Is there something wrong with how I'm referencing context in the Webhook body?

Are there known limitations or bugs in Kibana 9.0.3 affecting context.results for Elasticsearch Query rules?

Any insight or pointers are much appreciated :folded_hands:

2

Hello @Bhanu_Prasad_Santhal

Welcome to the community!!

I have tried in 9.0.3 and do not see any issue. Tried using webhook.site as well, to start with try below in action :

{
    "debug" : "{{context}}"
}

You will receive all the details in debug . As per your requirement can fetch the fields from context.

Thanks!!