# How is webhook used in elasticsearch , and how is logstash used for webhook

**URL:** <https://discuss.elastic.co/t/how-is-webhook-used-in-elasticsearch-and-how-is-logstash-used-for-webhook/183291>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 29, 2019, 9:32am UTC](https://discuss.elastic.co/t/how-is-webhook-used-in-elasticsearch-and-how-is-logstash-used-for-webhook/183291 "2019-05-29T09:32:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [May 29, 2019, 9:32am UTC](https://discuss.elastic.co/t/how-is-webhook-used-in-elasticsearch-and-how-is-logstash-used-for-webhook/183291/1 "2019-05-29T09:32:40Z")

</div>

Please help..

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 29, 2019, 11:34am UTC](https://discuss.elastic.co/t/how-is-webhook-used-in-elasticsearch-and-how-is-logstash-used-for-webhook/183291/2 "2019-05-29T11:34:18Z")

</div>

please take your time to properly write up a question that consists of more than just a subject line. I don't think it's good to expect from anyone else to know all the context that you have behind this question.

1. What are you referring to? Is this the webhook of the alerting component? If so, just write that. Or link to the docs.
2. If the above is correct, how do make the connection between that webhook and logstash? Why are those two linked for you? Again context would be helpful.
3. What problem are you trying to solve in general that you took a look at these two mentioned components? Maybe there is a simpler way to solve this. Just sit back and talk about the setup you got and the problem you are trying to solve within a few words.
4. Are there any code or architectural samples that you can share with your problem, so others can try and reproduce. If not that's fine as long as other explanations are given.
5. Please take a look at [https://www.elastic.co/help](https://www.elastic.co/help)

We're happy to help, but you have to give a little more before getting something back - in this case it is just more information 🙂

---

<div class="post-metadata">

**Author:** ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)\
**Post date:** [May 29, 2019, 12:32pm UTC](https://discuss.elastic.co/t/how-is-webhook-used-in-elasticsearch-and-how-is-logstash-used-for-webhook/183291/3 "2019-05-29T12:32:03Z")

</div>

Thank you Sir,  
Actually i want to create an alert using webhook when my portal is down

```
PUT _xpack/watcher/watch/watcher10
{
  "trigger" : {
    "schedule" : { "cron" : "* */1 * * * ?" }
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : [
          "heartbeat-*"
        ],
        "body" : {
          "size": 1,
          "query" : {
            "bool" : {
              "must": [
                {
                  "term": {
                    "monitor.status": {
                      "value": "down"
                    }
                  }
                }
              ],
              "filter" : {
                "range": {
                  "@timestamp": {
                    "from": "{{ctx.trigger.scheduled_time}}||-5m",
                    "to": "{{ctx.trigger.triggered_time}}"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
  },
  "actions" : {
    "email_admin" : {
      "email" : {
        "to" : "vishnumk@nseit.com",
        "subject" : "Priority : High State : Down ",
        "body": {
      "text": "Portal_URL:{{#ctx.payload.hits.hits}} {{_source.http.url}} {{/ctx.payload.hits.hits}}\n Time:{{#ctx.payload.hits.hits}} {{_source.@timestamp}} {{/ctx.payload.hits.hits}}\n Error:{{#ctx.payload.hits.hits}} {{_source.error.message}} {{/ctx.payload.hits.hits}}" 
    }
      }
    }
  }
 }

```

Now instead of email alert i want to use webhook alert . I dont know what steps i should take to proceed with webhook.

Regards

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 3, 2019, 12:07pm UTC](https://discuss.elastic.co/t/how-is-webhook-used-in-elasticsearch-and-how-is-logstash-used-for-webhook/183291/4 "2019-06-03T12:07:41Z")

</div>

You have to replace the `email` action with a `webhook` action. Like mentioned here [https://www.elastic.co/guide/en/elastic-stack-overview/current/actions-webhook.html](https://www.elastic.co/guide/en/elastic-stack-overview/current/actions-webhook.html)

specify an endpoint where to sent the data to (optionally change the data) and you are good to go.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2019, 12:07pm UTC](https://discuss.elastic.co/t/how-is-webhook-used-in-elasticsearch-and-how-is-logstash-used-for-webhook/183291/5 "2019-07-01T12:07:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.