Configure a Slack watcher alert from the UI

Elastic Stack Kibana
1

I'm using Elastic Cloud, with ElasticSearch version 7.

I've configured the Slack URL using the Keystore UI in the Cloud admin console for my cluster with single value named "xpack.notification.slack.account.monitoring.secure_url". I restarted the cluster to make sure the KeyStore entry was set/added. Then in Kibana I'm trying to add the Slack action to a watcher but I don't know what to put in the "Recipient" field? I've tried everything I can think of and there is very little documentation on how to configure things using the UI.

Sending the test message results in the error message. "[illegal_argument_exception] no accounts of type [slack] configured. Please set up an account using the [xpack.notification.slack] settings". So have I configured the KeyStore wrong or the Watcher wrong?

2

Hello @cgfrost

To add slack for the kibana you need to make some changes in elasticsearch.yml

In the elasticsearch edit the configuration file of elasticsearch i.e elasticsearch.yml
And paste the following

	xpack.notification.slack :
	     account :
                            monitoring :
                                  url : < your slack url >

for slack url you need to create it from slack settings

3

As of version 7.0 this can no longer be configured in the elasticsearch.yml file
. It has to be done through the keystore. Unless I miss-read the docs and release notes. I did try and apply the config through the config file but they failed to be deployed which I took as confirmation that they have been removed.

https://www.elastic.co/guide/en/elastic-stack-overview/7.0/actions-slack.html#configuring-slack
https://www.elastic.co/guide/en/elasticsearch/reference/current/breaking-changes-7.0.html#watcher-notifications-account-settings

4

@cgfrost were you able to solve this? I'm coming up against the same problem

5

No. I've not put any more effort in to it so still not working.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.