Hi,
We're trying to create a new document in the "action" part. We would like to index this document in the alert-index. We're trying this:
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"pymon*"
],
"types": [],
"body": {
"query": {
"bool": {
"must": {
"match": {
"type": "microsoft.insights/components"
}
},
"filter": {
"bool": {
"must": [
{
"range": {
"date_time": {
"gte": "now-5m/m"
}
}
},
{
"range": {
"requests/duration": {
"gte": 1
}
}
}
]
}
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 1
}
}
},
"throttle_period_in_millis": 900000,
"actions": {
"enterpriseAlert": {
"webhook": {
"scheme": "https",
"host": "enterprisealert.arxus.eu",
"port": 443,
"method": "post",
"path": "eawebservice/rest/events?apiKey=w5shm3kx0wlafe28lv6g43dh50idip3u",
"params": {},
"headers": {},
"body": "title:there are {{ctx.payload.hits.total}} problems with AppInsights in Azure., type:backup/protectedItems, body:{ {{#ctx.payload.hits.hits}} client_name:{{_source.client_name}}, billing_id:{{_source.billing_id}}, object_name:{{_source.name}}, requests/duration:{{_source.requests/duration}},{{/ctx.payload.hits.hits}} }"
}
},
"index_payload":{
"index":{
"index":"alert",
"doc_type":"doc",
"resource":"AppInsights",
"total_errors":"{{ctx.payload.hits.total}}",
"classification":"P2",
"client_names_and_appnames":"{{#ctx.payload.hits.hits}}{{_source.client_name}} - {{_source.name}}; {{/ctx.payload.hits.hits}}",
"date_time":"now"
}
}
}
}
And when we're trying to simulate the action "index_payload" we're getting the following error:
What are we doing wrong?