# Help with webhook action body format **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [July 30, 2017, 1:11pm UTC](https://discuss.elastic.co/t/help-with-webhook-action-body-format/95077 "2017-07-30T13:11:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![devans](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devans/32/21073_2.png) [@devans](https://discuss.elastic.co/u/devans)\ **Post date:** [July 30, 2017, 1:11pm UTC](https://discuss.elastic.co/t/help-with-webhook-action-body-format/95077/1 "2017-07-30T13:11:43Z")
I'm having problems formatting the json correctly in the body of a webhook action. I'm trying to index a new document into a different index. ```auto { "trigger": { "schedule": { "interval": "5m" } }, "input": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ "metricbeat-*" ], "types": [], "body": { "query": { "bool": { "filter": [ { "term": { "host": "{{ctx.metadata.monitor_host}}" } }, { "range": { "@timestamp": { "gte": "now-5m", "lt": "now" } } } ] } } } } } }, "actions": { "index_healthy": { "condition": { "compare": { "ctx.payload.hits.total": { "gt": 0 } } }, "webhook": { "method": "POST", "host": "192.168.100.101", "port": 9200, "path": "/health-{now/d}/server/", "body": "{ \"@timestamp\": \"{{now}}\", \"host\": \"{{ctx.metadata.monitor_host}}\", \"healthscore\": 0 }", "auth": { "basic": { "username": "", "password": "" } } }, "send_email": { "condition": { "compare": { "ctx.payload.hits.total": { "lte": 0 } } }, "throttle_period_in_millis": 1800000, "transform": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ "metricbeat-*" ], "types": [], "body": { "size": 0, "query": { "bool": { "filter": { "term": { "host": "{{ctx.metadata.monitor_host}}" } } } } } } } }, "email": { "profile": "standard", "to": [ "admin@example.com" ], "subject": "ALERT: {{ctx.metadata.monitor_host}} Server Not Responding", "body": { "html": "{{ctx.metadata.monitor_host}} Not Responding" } } } }, "metadata": { "monitor_host": "serverA.example.com", "last_period": "5m", "window_period": "24h" } } ``` ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [July 31, 2017, 6:19am UTC](https://discuss.elastic.co/t/help-with-webhook-action-body-format/95077/2 "2017-07-31T06:19:52Z")
Hey, as `body` is a string field, the easiest way to create properly formatted JSON is to use a [script transform](https://www.elastic.co/guide/en/x-pack/5.5/transform-script.html) in your action to basically create the JSON structure. You can then use the [`#toJson`](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/search-template.html#_converting_parameters_to_json) directive to convert this easily into JSON. One more thing: currently your path is configured wrong. How is Elasticsearch supposed to know that the `/` sign or the `now/d` expression is supposed to be escaped but the others are not? It's not, so you have to URL encode special chars like `< > { } /` yourself before sending that data. Hope that helps! Also in order to debug issues further, please paste the output of the execute watch API here, that allows to follow the execution path. --Alex ---
**Author:** ![devans](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devans/32/21073_2.png) [@devans](https://discuss.elastic.co/u/devans)\ **Post date:** [August 8, 2017, 12:07pm UTC](https://discuss.elastic.co/t/help-with-webhook-action-body-format/95077/3 "2017-08-08T12:07:52Z")
Hi Alex, Thank you. The script transform worked. I did switch from using a webhook action to using a index action. Everything works, except I can't figure out how to create a dynamic index name with a date. Below is the action that works with a static index name. I've tried URL encoding the index name and using a mustache template, but both throw an illegal character error. ```auto "index_healthy": { "condition": { "compare": { "ctx.payload.hits.total": { "gt": 0 } } }, "transform": { "script": { "inline": "return ['@timestamp':ctx.trigger.triggered_time,'host':ctx.metadata.monitor_host,'healthscore':0, 'type': 'server']", "lang": "painless" } }, "index": { "index": "health", "doc_type": "doc" } }, ``` ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 8, 2017, 12:23pm UTC](https://discuss.elastic.co/t/help-with-webhook-action-body-format/95077/4 "2017-08-08T12:23:56Z")
Hey, you can leverage the [date math support in index names](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/date-math-index-names.html). Just specify something like `` in the index name and Elasticsearch will do all the lookup work. Hope this helps! --Alex ---
**Author:** ![devans](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devans/32/21073_2.png) [@devans](https://discuss.elastic.co/u/devans)\ **Post date:** [August 8, 2017, 3:01pm UTC](https://discuss.elastic.co/t/help-with-webhook-action-body-format/95077/5 "2017-08-08T15:01:22Z")
Thank you Alex. This worked. I had missed the \<\> around the index name previously. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 5, 2017, 3:01pm UTC](https://discuss.elastic.co/t/help-with-webhook-action-body-format/95077/6 "2017-09-05T15:01:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.