# HTTP request in Watcher transform

**URL:** <https://discuss.elastic.co/t/http-request-in-watcher-transform/206553>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [November 5, 2019, 8:59am UTC](https://discuss.elastic.co/t/http-request-in-watcher-transform/206553 "2019-11-05T08:59:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gerard1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gerard1/32/53507_2.png) [@gerard1](https://discuss.elastic.co/u/gerard1)\
**Post date:** [November 5, 2019, 8:59am UTC](https://discuss.elastic.co/t/http-request-in-watcher-transform/206553/1 "2019-11-05T08:59:09Z")

</div>

Before sending a Watcher alert into Slack, I would like to check with an external API, for example, if an IP has been reported as abusive in public databases.

Is possible to do so with Painless or any other transform scripts?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 5, 2019, 9:41am UTC](https://discuss.elastic.co/t/http-request-in-watcher-transform/206553/2 "2019-11-05T09:41:38Z")

</div>

Hey,

in order to understand if/how this works, this requires some explanation about watcher. All actions are executed in sequence, but they cannot modify the payload, so you cannot use an action to look things up.

What you could try however is a [chain input](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/input-chain.html), where you execute a search first, then use a transform to extract the ips from the search, create a proper HTTP body and then execute a http input to query for those ip addresses.

Lastly you can use the input of the search and of the http input to decide if you need to trigger a slack message.

Hope that makes sense!

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 3, 2019, 9:41am UTC](https://discuss.elastic.co/t/http-request-in-watcher-transform/206553/3 "2019-12-03T09:41:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.