# Alert that responds to result of webhook **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [April 1, 2019, 3:36pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810 "2019-04-01T15:36:18Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![nielsoncr](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Post date:** [April 1, 2019, 3:36pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/1 "2019-04-01T15:36:18Z")
I would like to be able to write an alert (watch) that executes a webhook on a schedule like every hour and sends a notification email if error http statuses occur. Is this supported, or do I have to have one watch to run the scheduled webhook and another watch to monitor the first watch's results? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 2, 2019, 10:43am UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/2 "2019-04-02T10:43:03Z")
This is a common use-case. Your watch would look like this 1. Input: The input would be a search over the data from the last hour, that would be filtered based on the error condition (i.e. status code greater than equals 400 or 500 for example) 2. Condition: Your condition would check if the number of hits returned by that search is greater than zero 3. Action: Your action would be the sending of the email Hope this helps! --Alex ---
**Author:** ![nielsoncr](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Post date:** [April 3, 2019, 9:38pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/3 "2019-04-03T21:38:14Z")
This helps. I have made some progress. I have this watch that uses a chained input to get the results of a http input but I'm unable to access the result in the condition script which doesn't work. I'd like to be able to get the http status\_code and the input.status in case the http call completely fails { "trigger": { "schedule": { "hourly": { "minute": [5] } } }, "input": { "chain": { "inputs": [ { "jira\_http": { "http": { "request": { "scheme": "https", "host": "[jira.mydomain.com](http://jira.mydomain.com)", "port": 443, "method": "get", "path": "/rest/api/2/issue/createmeta?projectKeys=MY-KEY", "params": {}, "headers": { "Authorization": "Basic {{ctx.metadata.JIRA\_Authorization}}" } } } } } ] } }, "condition": { "script": { "source": "return ctx.payload.jira\_http.status != "success" || ctx.payload.jira\_http.\_status\_code != 200", "lang": "painless" } }, "actions": { "email\_report": { "email": { "profile": "standard", "to": [ "me@myemail.com" ], "subject": "{{ctx.metadata.email\_subject}}", "body": { "html": " # {{ctx.metadata.email\_body\_header}} ### ctx.payload.jira\_http : [{{ctx.payload.jira\_http}}] Executed watch [{{ctx.watch\_id}}] at [{{ctx.execution\_time}}]. Do not reply to this email. The sending account is not monitored." } } } }, "metadata": { "email\_body\_header": "ES WATCHER TEST: JIRA connectivity test FAILED TEST Environment", "JIRA\_Authorization": "SECRET", "email\_subject": "ES WATCHER TEST: JIRA connectivity test FAILED TEST Environment" } } When I simulate the watch I get this result How do I access the field marked with \*\*\* in the condition "result": { "execution\_time": "2019-04-03T21:08:08.986Z", "execution\_duration": 722, "input": { "type": "chain", "status": "success", "payload": { "jira\_http": { "\_headers": { "date": [ "Wed, 03 Apr 2019 21:08:08 GMT" ], "server": [ "Apache" ], "x-asessionid": [ "k3w8p1" ], "transfer-encoding": [ "chunked" ], "vary": [ "Accept-Encoding,User-Agent" ], "x-frame-options": [ "ALLOWALL", "SAMEORIGIN" ], "strict-transport-security": [ "max-age=63072000; includeSubDomains" ], "set-cookie": [ "JSESSIONID=498D7941D9B863F712644D3D09CAE9F1;path=/;Secure;HttpOnly" ], "x-seraph-loginreason": [ "OK" ], "keep-alive": [ "timeout=15, max=1000" ], "content-security-policy": [ "frame-ancestors \*.mydomain.com \*.sharepoint.com ;", "frame-ancestors 'self'" ], "x-content-type-options": [ "nosniff" ], "x-xss-protection": [ "1; mode=block" ], "x-ausername": [ "myfakeusername" ], "x-arequestid": [ "968x7492054x5" ], "connection": [ "Keep-Alive" ], "content-type": [ "application/json;charset=UTF-8" ], "served-by": [ "epig-01" ], "cache-control": [ "no-cache, no-store, no-transform," ], "x-asen": [ "SEN-L13339226" ] }, "expand": "projects", "projects": , "\_status\_code": 200 } }, "chain": { "jira\_http": { "type": "http", "status": "success", \*\*\* "payload": { "\_headers": { "date": [ "Wed, 03 Apr 2019 21:08:08 GMT" ], "server": [ "Apache" ], "x-asessionid": [ "k3w8p1" ], "transfer-encoding": [ "chunked" ], "vary": [ "Accept-Encoding,User-Agent" ], "x-frame-options": [ "ALLOWALL", "SAMEORIGIN" ], "strict-transport-security": [ "max-age=63072000; includeSubDomains" ], "set-cookie": [ "JSESSIONID=498D7941D9B863F712644D3D09CAE9F1;path=/;Secure;HttpOnly" ], "x-seraph-loginreason": [ "OK" ], "keep-alive": [ "timeout=15, max=1000" ], "content-security-policy": [ "frame-ancestors \*.mydomain.com \*.sharepoint.com ;", "frame-ancestors 'self'" ], "x-content-type-options": [ "nosniff" ], "x-xss-protection": [ "1; mode=block" ], "x-ausername": [ "myfakeusername" ], "x-arequestid": [ "968x7492054x5" ], "connection": [ "Keep-Alive" ], "content-type": [ "application/json;charset=UTF-8" ], "served-by": [ "epig-01" ], "cache-control": [ "no-cache, no-store, no-transform," ], "x-asen": [ "SEN-L13339226" ] }, "expand": "projects", "projects": , "\_status\_code": 200 \*\*\* }, "http": { "request": { "host": "[jira.mydomain.com](http://jira.mydomain.com)", "port": 443, "scheme": "https", "method": "get", "path": "/rest/api/2/issue/createmeta?projectKeys=MY-KEY", "headers": { "Authorization": "Basic MySecret" } }, "status\_code": 200 } } } } ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 3, 2019, 9:55pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/4 "2019-04-03T21:55:37Z")
please take the time to properly format your messages, this is nearly impossible to read. You can only access data within the `payload` field. ---
**Author:** ![nielsoncr](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Post date:** [April 3, 2019, 10:36pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/5 "2019-04-03T22:36:06Z")
The important part is I have a chained http input named jira\_http that returns a result that includes a \_status\_code field. I want the action of my watch to execute if \_status\_code != 200 "condition": { "script": { "source": "return ctx.payload.jira\_http.\_status\_code != 200", "lang": "painless" } ctx.payload.jira\_http contains the \_status\_code field as shown, but the syntax for accessing it in the condition script isn't working. [{\_headers={date=[Wed, 03 Apr 2019 21:42:06 GMT], ..... \_status\_code=200}] ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 4, 2019, 9:35am UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/6 "2019-04-04T09:35:55Z")
that field is within the `._headers` field, which you are not referring to in the script ---
**Author:** ![nielsoncr](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Post date:** [April 4, 2019, 3:14pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/7 "2019-04-04T15:14:07Z")
This condition worked. It does not seem possible to access the chained input's status field. ` "condition": { "compare": { "ctx.payload.jira_http._status_code": { "not_eq": 200 } } }` ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 4, 2019, 3:28pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/8 "2019-04-04T15:28:23Z")
both of these work for me. do they fail on your side? ```auto POST _xpack/watcher/watch/_execute { "watch": { "trigger": { "schedule": { "interval": "10h" } }, "input": { "chain": { "inputs": [ { "first": { "http": { "request": { "url" : "https://httpbin.org/status/233" } } } } ] } }, "condition": { "script": "return ctx.payload.first._status_code == 233" }, "actions": { "logme": { "logging": { "text": "{{ctx}}" } } } } } POST _xpack/watcher/watch/_execute { "watch": { "trigger": { "schedule": { "interval": "10h" } }, "input": { "chain": { "inputs": [ { "first": { "http": { "request": { "url": "https://httpbin.org/status/233" } } } } ] } }, "condition": { "compare": { "ctx.payload.first._status_code": { "eq": 233 } } }, "actions": { "logme": { "logging": { "text": "{{ctx}}" } } } } } ``` ---
**Author:** ![nielsoncr](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@nielsoncr](https://discuss.elastic.co/u/nielsoncr)\ **Post date:** [April 4, 2019, 9:05pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/9 "2019-04-04T21:05:59Z")
Yes it works on my end -- You essentially posted the same thing as my last post. The value I was attempting to access is the result.success field from the watch result below. Since this value is at the same level as payload instead of inside it I now understand it is not available. The payload.{input\_name}.\_status\_code condition test will be sufficient. ` "result": { "execution_time": "2019-04-03T21:08:08.986Z", "execution_duration": 722, "input": { "type": "chain", "status": "success", "payload": {....} ` Thank you for responding ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 2, 2019, 9:05pm UTC](https://discuss.elastic.co/t/alert-that-responds-to-result-of-webhook/174810/10 "2019-05-02T21:05:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.