Error when creating email action with data attachment

Elastic Stack Elasticsearch
1

I have configured the following action for a watcher

                            "actions" : {
                              "watcher_email" : {
                                "email": {
                                  "account": "outlook_account",
                                  "to": "'<testUser@domain.com>'",
                                  "subject" : "Watcher Fatal Alert: {{ctx.payload.hits.total}} log entries --- severity: Fatal",
                                  "body" : "Watcher \"{{ctx.watch_id}}\" Encountered {{ctx.payload.hits.total}} log entries, see attached data",
                                  "attachments" : {
                                    "incidentData.json" : {
                                      "data" : {
                                        "format" : "json"
                                      }
                                    }
                                  },
                                  "priority" : "high"
                                }
                              }
                            }

and am getting the following error

{
"error": {
"root_cause": [1]
0: {
"type": "parse_exception"
"reason": "could not parse [email] action [inlined/watcher_email]. unexpected token [START_OBJECT]"
}-

"type": "parse_exception"
"reason": "could not parse [email] action [inlined/watcher_email]. unexpected token [START_OBJECT]"
}-
"status": 400
}

without the attachment element, the email action parses and executes with no errors

would appreciate your help

2

Hey,

can you provide more information of the version you are running this against? I just tried this watch and it worked flawless on elasticsearch 2.3.1

PUT /_watcher/watch/test-watch
{
  "trigger": {
    "schedule": {
      "interval": "10h"
    }
  },
  "actions": {
    "watcher_email": {
      "email": {
        "to": "'<testUser@domain.com>'",
        "subject": "Watcher Fatal Alert: {{ctx.payload.hits.total}} log entries --- severity: Fatal",
        "body": "Watcher \"{{ctx.watch_id}}\" Encountered {{ctx.payload.hits.total}} log entries, see attached data",
        "attachments": {
          "incidentData.json": {
            "data": {
              "format": "json"
            }
          }
        },
        "priority": "high"
      }
    }
  }
}

POST /_watcher/watch/test-watch/_execute

Also maybe the full watch would help, in case the parsing gets borked somewhere in the code.

--Alex

3

Thank you Alex.

The issue was the version. After upgrading to 2.3.2, I was able to configure the email action with no errors.

I have an additional question...

Is there a way to the have the original query ("input":slight_smile: to be included in the email attachment?

Regards,
Eric