How to pass variable to the body section of script in webhook watcher?

Elastic Stack Elasticsearch
,
1

I have the following webhook watcher which creates OTRS ticket when there is a term "Error" in document. However right now the ticket body declared in script is a fixed string for now ( This is only a test). How to pass the message body to the script so that when the ticket is created it desplays the actual message of the input?

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "Error"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "create_otrs": {
      "transform": {
        "script": {
          "source": "return ['Ticket':['Queue':'Engineering Team','Priority':'P3','CustomerUser':'root','Title':'RESTCreateTest','State':'new','Type':'Incident'],'Article':['ContentType':'text/plain;charset=utf8','Subject':'RestCreateTest','Body':'This is only a test']]",
          "lang": "painless"
        }
      },
      "webhook": {
        "scheme": "http",
        "host": "myotrs.com",
        "port": 80,
        "method": "post",
        "path": "/otrs/GenericTicketConnectorREST/User=<User>&Pass=<Password>",
        },
        "headers": {},
        "body": "{{#toJson}}ctx.payload{{/toJson}}"
      }
    }
  }
}

One of the example hit is -

"_index": ".ds-logs-elastic_agent.filebeat-default",
                "_source": {
                  "input_source": "https://ser.example.com:80/export",
                  "agent": {
                    "name": "syslog01",
                    "id": "5836558b-b17d-445e",
                    "type": "filebeat",
                    "ephemeral_id": "36bdfeca-3c60",
                    "version": "8.3.3"
                  },
                  "service.name": "filebeat",
                  "log": {
                    "file": {
                      "path": "/opt/Elastic/Agent/data/elastic-agent-0ffbed/logs/default/filebeat-20230127-12.ndjson"
                    },
                    "offset": 248078415
                  },
                  "elastic_agent": {
                    "id": "5836558b-b17d",
                    "version": "8.3.3",
                    "snapshot": false
                  },
                  "message": """Error while processing http request: failed to execute rf.collectResponse: failed to execute http client.Do: failed to execute http client.Do: Post "https://ser.example.com:80/export": POST https://ser.example.com:80/export giving up after 6 attempts""",
                  "log.logger": "input.httpjson-cursor",
                  "input": {
                    "type": "filestream"
                  },
                  "log.origin": {
                    "file.line": 128,
                    "file.name": "httpjson/input.go"
                  },
                  "@timestamp": "2023-01-27T14:44:42.790Z",
                  "ecs": {
                    "version": "8.0.0"
                  },
                  "data_stream": {
                    "namespace": "default",
                    "type": "logs",
                    "dataset": "elastic_agent.filebeat"
                  },
                  "host": {
                    "hostname": "syslog01",
                    "os": {
                      "kernel": "3.10.25-gentoo",
                      "name": "Gentoo",
                      "type": "linux",
                      "family": "",
                      "version": "",
                      "platform": "gentoo"
                    },
                    "containerized": false,
                  "log.level": "error",
                  "input_url": "https://ser.example.com:8089/export",
                  "id": "httpjson-system.security-ba2ec41b-457b-442a",
                  "event": {
                    "agent_id_status": "verified",
                    "ingested": "2023-01-27T14:44:58Z",
                    "dataset": "elastic_agent.filebeat"
                  }
                },
                "_id": "pCWw84UB8FDLddfs",
                "_score": 2.2840834
              },

I want to pass the "message" field of the document into the script in 'Body':'This is only a test'

2

Just make your transform script something like:

        "transform": {
          "script": """return ['Ticket':['Queue':'EngineeringTeam','Priority':'P3','CustomerUser':'root@localhost','Title':'RESTCreateTest','State':'new','Type':'Incident'],'Article':['ContentType':'text/plain;charset=utf8','Subject':'RestCreateTest','Body':ctx.payload.hits.hits.0._source.message]]"""
        },

But, of course, this is the message field for only the first (out of possibly many) documents that matched the input query. If you're okay with that....

3

Thank you so much. Its working fine.