Generate custom report and automate sending using watcher

I have a saved search which when exported as csv from the discover page works fine, i then copy the url and create a watcher following to process here:

But the watcher fails and we get an error:

Watch[7849323b-dd39-45ef-813a-0468d92d8d5a] reporting[error_report.csv] Error when polling pdf from host[], port[443], method[POST], path[/api/reporting/generate/csv], status[500], body[{"message":"Reporting generation failed","reason":"Error: Expected _scroll_id in the following Elasticsearch response: {\"took\":1,\"timed_out\":false,\"_shards\":{\"total\":0,\"successful\":0,\"skipped\":0,\"failed\":0},\"_clusters\":{\"total\":1,\"successful\":1,\"skipped\":0},\"hits\":{\"total\":{\"value\":0,\"relation\":\"eq\"},\"max_score\":0,\"hits\":}}"}]"

Can anyone please help.


Hi, seems that with the POST URL used, no document is found, please check the time range used by the POST URL to be sure that it reflects a valid interval with data.

cc @joelgriffith

In the discover page with the same post url i am able to see hits markov, however now when i tried with a different user it just says:

"reason": "Watch[37356167-fcab-433b-ae9f-8daf3c02442f] reporting[error_report.csv] Error response when trying to trigger reporting generation host[], port[443] method[POST], path[/api/reporting/generate/csv], status[500]"


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.