# How to get kubernetes namespace in webhook alert payload?

**URL:** <https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [October 15, 2021, 10:25pm UTC](https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877 "2021-10-15T22:25:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AndyLibrian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andylibrian/32/95970_2.png) [@AndyLibrian](https://discuss.elastic.co/u/AndyLibrian)\
**Post date:** [October 15, 2021, 10:25pm UTC](https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877/1 "2021-10-15T22:25:48Z")

</div>

Hi. Does anyone know how to get kubernetes namespace in webhook alert payload from metricbeat k8s module? Or more generically, how to access the event data to include in the payload?

I installed metricbeat on kubernetes using this guide: [Run Metricbeat on Kubernetes | Metricbeat Reference [7.15] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/current/running-on-kubernetes.html)

and I got this data:

 ![Screenshot from 2021-10-15 06-32-40](https://us1.discourse-cdn.com/elastic/original/3X/e/6/e6ae2af9a6c542036ea8074acb020fc1d54e12b6.png)

However, when I created a webhook alert, with this payload to see the all available properties:

```auto
alert:
{{alert}}

context:
{{context}}

```

This is the only data included:

```auto
alert:
{\"id\":\"ubuntu\",\"actionGroup\":\"metrics.inventory_threshold.fired\",\"actionGroupName\":\"Alert\"}

context:
{\"group\":\"ubuntu\",\"alertState\":\"ALERT\",\"reason\":\"CPU usage is greater than a threshold of 80 (current value is 99.9%)\",\"timestamp\":\"2021-10-14T22:56:11.799Z\",\"value\":{\"condition0\":\"99.9%\"},\"threshold\":{\"condition0\":[80]},\"metric\":{\"condition0\":\"cpu\"}}

```

Anyone know how to include the **kubernetes.namespace** from the source to the alert payload? I need it to be able to identify the pod in the alert uniquely.

---

<div class="post-metadata">

**Author:** ![brianseeders](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brianseeders/32/84831_2.png) [@brianseeders](https://discuss.elastic.co/u/brianseeders)\
**Post date:** [October 21, 2021, 9:01pm UTC](https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877/2 "2021-10-21T21:01:05Z")

</div>

Hey @AndyLibrian,

I don't believe you're able to access the entire document for those alerts in the context of the webhook payload.

However, if you're able to craft your alert as an [Elasticsearch query alert](https://www.elastic.co/guide/en/kibana/current/rule-type-es-query.html), you'll get access some documents in your payload.

I set one up with a payload defined like this:

```auto
{{context.hits.0}}

{{context.hits.0._source.agent}}

```

which resulted in this:

```auto
{\"_index\":\"kibana_sample_data_logs\",\"_type\":\"_doc\",\"_id\":\"OvoYpHwBZdnJynTDaaMV\",\"_score\":null,\"_source\":{\"agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\",\"bytes\":6928,\"clientip\":\"34.98.136.159\",\"extension\":\"\",\"geo\":{\"srcdest\":\"IN:CA\",\"src\":\"IN\",\"dest\":\"CA\",\"coordinates\":{\"lat\":41.87877778,\"lon\":-92.28456944}},\"host\":\"www.elastic.co\",\"index\":\"kibana_sample_data_logs\",\"ip\":\"34.98.136.159\",\"machine\":{\"ram\":17179869184,\"os\":\"win 7\"},\"memory\":null,\"message\":\"34.98.136.159 - - [2018-08-02T20:06:51.816Z] \\\"GET /elasticsearch HTTP/1.1\\\" 200 6928 \\\"-\\\" \\\"Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1\\\"\",\"phpmemory\":null,\"referer\":\"http://www.elastic-elastic-elastic.com/success/ulrich-walter\",\"request\":\"/elasticsearch\",\"response\":200,\"tags\":[\"success\",\"info\"],\"timestamp\":\"2021-10-21T20:06:51.816Z\",\"url\":\"https://www.elastic.co/downloads/elasticsearch\",\"utc_time\":\"2021-10-21T20:06:51.816Z\",\"event\":{\"dataset\":\"sample_web_logs\"}},\"fields\":{\"@timestamp\":[\"2021-10-21T20:06:51.816Z\"]},\"sort\":[1634846811816]}

Mozilla/5.0 (X11; Linux x86_64; rv:6.0a1) Gecko/20110421 Firefox/6.0a1

```

Hope this helps.  
Brian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 18, 2021, 9:02pm UTC](https://discuss.elastic.co/t/how-to-get-kubernetes-namespace-in-webhook-alert-payload/286877/3 "2021-11-18T21:02:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.