# I am trying to Use Webhook connector from ELK- Need Help
**URL:** https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901
**Category:** Kibana
**Created:** [January 12, 2024, 4:14am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901 "2024-01-12T04:14:06Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@MOHAMMED\_ASIF\_Z](https://discuss.elastic.co/u/MOHAMMED_ASIF_Z)
#### Post date: [January 12, 2024, 4:14am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901/1 "2024-01-12T04:14:06Z")
I am capturing IBM Tivoli Schedular logs using Elastic stach - so my idea is to retrigger a failed job based on the reasoning, so using query on the specify field i could get only the failure , but i want to try reach out to tivoli via webhook connectors for rerunning the job. How to do that?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [January 12, 2024, 4:32pm UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901/2 "2024-01-12T16:32:01Z")
> [@MOHAMMED\_ASIF\_Z](#):
>
> How to do that?
You would need to configure your Webhook connector with the endpoint and credentials and then construct a payload in the alert action, this is explained in the [documentation](https://www.elastic.co/guide/en/kibana/current/webhook-action-type.html).
Also, do you have a paid license? The webhook connector requires a paid license.
---
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 17, 2024, 3:29pm UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901/3 "2024-01-17T15:29:52Z")
Hi,
Most probably you can use a watcher too.
I am now aware of licensing issues with it.
```auto
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"xxxxxxxxxxxxx*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-30m"
}
}
}
]
}
},
"aggs": {
"hostnames": {
"terms": {
"field": "observer.hostname",
"size": 100
},
"aggs": {
"docs_per_5m": {
"date_range": {
"field": "@timestamp",
"ranges": [
{
"to": "now"
},
{
"from": "now-5m"
}
]
},
"aggs": {
"last_bucket": {
"bucket_sort": {
"sort": [
{
"_key": {
"order": "desc"
}
}
],
"size": 1,
"gap_policy": "insert_zeros"
}
}
}
}
}
}
}
}
}
}
},
"condition": {
"script": {
"source": """
for (def host : ctx.payload.aggregations.hostnames.buckets) {
for (def buckt_docs : host.docs_per_5m.buckets) {
if (buckt_docs.doc_count == 0) {
return true;
}
}
}
""",
"lang": "painless"
}
},
"actions": {
"slack_web_hook": {
"transform": {
"script": {
"source": """
def failed_hosts = new ArrayList();
for (def host : ctx.payload.aggregations.hostnames.buckets) {
for (def buckt_docs : host.docs_per_5m.buckets) {
if (buckt_docs.doc_count == 0) {
def failed_host = new HashMap();
failed_host.put("host",host.key);
failed_host.put("doc_count",buckt_docs.doc_count);
failed_host.put("date",buckt_docs.from_as_string);
failed_hosts.add(failed_host);
}
}
}
return failed_hosts;""",
"lang": "painless"
}
},
"webhook": {
"scheme": "https",
"host": "hooks.slack.com",
"port": 443,
"method": "post",
"path": "services/.................",
"params": {},
"headers": {
"Content-Type": "application/json"
},
"body": """{"channel": "#abc-def-pqrst", "username": "webhookbot", "text": "{{#ctx.payload._value}}HaProxy ingest issue {{host}} has {{doc_count}} documents at {{date}}\n!{{/ctx.payload._value}}"}"""
}
}
}
}
```
Above a watcher with a webhook to a slack channel.
It checks the number of documents ingested per observer.hostname.
If it is 0 then the webhook is executed.
Regards Hans
---
### Author:  [@MOHAMMED\_ASIF\_Z](https://discuss.elastic.co/u/MOHAMMED_ASIF_Z)
#### Post date: [January 18, 2024, 3:17am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901/4 "2024-01-18T03:17:32Z")
Hi HansPeterSloot, Thanks for the reply, mine is just a simple check - index - mdss\_lineage-mdss\_tivoli\_job\* , log.message contains 'Procedure error' - it needs action - webhook connector to tivoli master to rerun the respective job. for the inputs i would like to provide JobName, JobID, Workstation as parameter to the URL - which TWS Admins are working to get. Also within Kibana UI - Webhook connector trying to connect and test shows the following error.
Test failed to run
The following error was found:
error calling webhook, request failed
Details:
[DEPTH\_ZERO\_SELF\_SIGNED\_CERT] self signed certificate
---
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 18, 2024, 9:11am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901/5 "2024-01-18T09:11:43Z")
Hello Mohammed
According to [https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/4](https://discuss.elastic.co/t/webhook-https-ignoring-verification-of-certificate/25874/4)
you should look at [https://www.elastic.co/guide/en/elasticsearch/reference/current/notification-settings.html#ssl-notification-settings](https://www.elastic.co/guide/en/elasticsearch/reference/current/notification-settings.html#ssl-notification-settings)
Regards Hans
---
### Author:  [@MOHAMMED\_ASIF\_Z](https://discuss.elastic.co/u/MOHAMMED_ASIF_Z)
#### Post date: [January 22, 2024, 10:37am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901/6 "2024-01-22T10:37:56Z")
Will Give it a try and for now - what we did was to include the host into yml - now at the Kibana level when given the webhook connector, with body as { } and run shows as "Test was successful", but then no flow seen to the destination host where the webhook should connect. - Not exactly sure how to move further to this in order to check if an connection calls or any infor was sent from ELK . based on the connector run button.
---
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 23, 2024, 11:45am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901/7 "2024-01-23T11:45:14Z")
What I described is a watcher and not a connector.
Those are 2 different things.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 20, 2024, 11:46am UTC](https://discuss.elastic.co/t/i-am-trying-to-use-webhook-connector-from-elk-need-help/350901/8 "2024-02-20T11:46:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.