Solved.
If you are using elastic cloud 7.7 you have to create in keystore (console elastic UI) that key xpack.notification.slack.account.account1.secure_url
and then in secret field you have to put Slack webhook.
Then if you want to use watcher, in your alert definition you have to put an action like this using the account1 that you create before.
"actions": {
"notify-slack": {
"throttle_period_in_millis": 1000,
"slack": {
"account": "account1",
"message": {
"to": [
"#env_dev"
],
"text": "Encountered {{ctx.payload.hits.total}} errors in the last 5 minutes :face_with_monocle:"
}
}
}
Enjoy!