Is it possible to use payload as input to an exec output command?


I have a watcher set up with multiple email actions where each email action has a conditional checking whats in the user field of the payload. For example, if user = 'userGroupA', then it will execute the action that sends email to Group A.

What I would like however, is instead of having a hardcoded list of whether user field = X, I would like to run a shell command that would return user information based on the user field within the payload as input.

Could I do something along the lines of:

output {
      if [user] == "userGroupA" {
        exec {
          command => "ldap <user>"

If this is possible, could I then use that output elsewhere in the watch?

There is no exec type action for Alerting sorry to say -

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.