Hi,
I configured watcher to get alerts for a particular error message. Here is my watcher code:
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"prod_log-*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"match": {
"type": "SystemError"
}
},
{
"match_phrase": {
"message": "A remote host refused an attempted connect operation."
}
},
{
"range": {
"@timestamp": {
"gte": "now-10000m",
"lte": "now"
}
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 10
}
}
},
"actions": {
"my-logging-action": {
"logging": {
"level": "info",
"text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10. The alert was detected at {{ctx.execution_time}}"
}
},
"send_email": {
"email": {
"to": "xxxx@gmail.com",
"subject": "Watcher Notification",
"body": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10. The alert was detected at {{ctx.execution_time}}"
}
}
}
}
When I run the watcher, I'm getting the following error:
IllegalArgumentException[no account found for name: [null]]
Additonally, I'm also noticing something weird, when I save the above watcher code, and I open it again it automatically chages part of the code to this:
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"xxxx@gmail.com"
],
"subject": "Watcher Notification",
"body": {
"text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10. The alert was detected at {{ctx.execution_time}}"
}
}
}
}
Is this causing the error?
Please also find below the elasticsearch.yml configuration:
xpack.notification.email.account:
gmail_account:
profile: gmail
smtp:
auth: true
starttls.enable: true
host: smtp.gmail.com
port: 587
user: xxxxx@gmail.com
password: xxxxxxxx
Please help.
Thanks