ElasticCloud Watcher slack-integration

[Ryan_Grannell (R* Grannell)]

Hi,

Are there any plans to add Slack-support to ElasticCloud's watcher instance? We currently monitor most of our IT infrastructure through slack, but we have a significant number of watchers that are sent to email, which is not ideal for us

Thanks,
Ryan

[spinscale (Alexander Reelsen)]

Hey,

I think I may have misunderstood your question. You can configure slack/hipchat accounts in cloud clusters, by specifying the right user settings. When you create a cluster there is IIRC also shown an example with a slack account.

The cloud docs also have a small section about this.

Hope this helps. Otherwise please rephrase your question, so I get it right

--Alex

[skearns (Steve Kearns)]

Note that slack support was added with Elasticsearch 2.0, so if you're running an Elasticsearch 1.x cluster in Elastic Cloud, you will need to upgrade to use Slack with Watcher.

Thanks,
Steve

[Ryan_Grannell (R* Grannell)]

Thanks Alexander, Steve,

I didn't get this running correctly through the Slack plugin (I was getting odd complaints about Cloudflare in my Watch history logs, I'd post an example but I can't find on right now):

I managed to get it working by making a direct HTTP request through the Watcher plugin, using the following code (the body isn't valid JSON, but follows the actual structure I use:

"slack": {
  "throttle_period": "3h",
  "webhook": {
    "scheme": "https",
    "host": "hooks.slack.com",
    "port": 443,
    "method": "post",
    "path": {
      "inline": "/services/*****/*****/*****"
    },
    "params": {},
    "headers": {
      "Content-Type": "application/json"
    },
    "body": "{  
      "username":   'watcher-bot',
      "icon_emoji": ':sleuth_or_spy:',
      "color":      'warning',
      "text":     'My Watcher Alert Content'

    }"
}

I excluded them, but I also have attachments that link to the Kibana logs / ElasticSearch logs for that particular Watch execution, to help debugging. Hopefully the above example can help someone else out, if they get stuck too

[spinscale (Alexander Reelsen)]

Hey,

if you find more information, I'd be happy to get my hands on it, maybe we can make the slack action more verbose/helpful in case of an error. Feel free to mail me at $firstname.$lastname@elastic.co.

Thanks a lot!

--Alex