Ctx.results in Kibana Alerting

Elastic Stack Kibana
1

Hi

I have created the below mustache template to send alert notification to slack.

Mustache Template:

  • Total hits: {{#ctx.results}}{{#hits}}{{total}}{{/hits}}{{/ctx.results}}
  • Period start: {{ctx.periodStart}}
  • Period end: {{ctx.periodEnd}}
  • Error Details:
    {{#ctx.results}}
    {{#hits}}
    {{#hits}}
    {{#_source}}
    StoreId: {{StoreId}}
    Env: {{Env}}
    App: {{App}} :
    LogType: {{LogType}}
    LogTime: {{LogTime}}
    LogDetails: {{LogDetails}}
    {{/_source}}
    {{/hits}}
    {{/hits}}
    {{/ctx.results}}

Result:

  • Total hits: 5
  • Period start: 2020-02-28T16:58:00Z
  • Period end: 2020-02-28T17:03:00Z
  • Error Details:
    StoreId: 7523434
    Env: prod
    App: S2SB :
    LogType: API_ERROR
    LogTime: 2020-02-28T16:28:40
    LogDetails: Error: TypeError: Network request failed
    StoreId: 7523434
    Env: prod
    App: S2SB :
    LogType: API_ERROR
    LogTime: 2020-02-28T16:35:24
    LogDetails: Error: TypeError: Network request failed
    StoreId: 7523434
    Env: prod
    App: S2SB :
    LogType: API_ERROR
    LogTime: 2020-02-28T16:48:21
    LogDetails: Error: TypeError: Network request failed
    StoreId: 7523434
    Env: prod
    App: S2SB :
    LogType: API_ERROR
    LogTime: 2020-02-28T16:58:29
    LogDetails: Error: TypeError: Network request failed
    StoreId: 8973452
    Env: prod
    App: S2SD :
    LogType: API_ERROR
    LogTime: 2020-02-28T16:46:21
    LogDetails: API ERROR FINAL:

Actually I need the output to be sorted with only one unique store id or I need to list the output in a Table format as StoreId, APP and Log Details alone.
Is there any possibilities to modify the mustache template according to that. I have tried multiple resources but no examples for unique or table format. If someone could help on this it would be very helpful

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.