Is Watcher webhook action support multi-document?

Elastic Stack Elasticsearch
1

Hi there,

I am try to use watcher to post the data from one elastic cloud cluster to another one.
But seems like the multi-document support is not working
multi-document support

And I saw a discussion before mentioned that index action do support.
https://discuss.elastic.co/t/watcher-webhook-action-with-bulk-request/72333/2?u=izek

But in my case, it failed
here are the details

          "webhook" : {
            "request" : {
              "host" : "host",
              "port" : 9243,
              "scheme" : "https",
              "method" : "post",
              "path" : "/decaf-watcher/watcher",
              "params" : {
                "id" : "monitor-by-system"
              },
              "headers" : {
                "Content-Type" : "application/json"
              },
              "auth" : {
                "basic" : {
                  "username" : "logstash_write_user",
                  "password" : "::es_redacted::"
                }
              },
              "body" : """{"_doc":[{"issue":"issue1","@timestamp":"2019-11-13T09:03:36.848704Z","element":"ABC123"},{"issue":"issue2","@timestamp":"2019-11-13T09:03:36.848704Z","element":"ABC456"}]}"""
            },
            "response" : {
              "status" : 200,
              "headers" : {
                "date" : [
                  "Wed, 13 Nov 2019 09:03:36 GMT"
                ],
                "x-cloud-request-id" : [
                  "f9bafffe-eb96-46dc-a035-26ff543fbcc0"
                ],
                "connection" : [
                  "keep-alive"
                ],
                "content-type" : [
                  "application/json; charset=UTF-8"
                ],
                "x-found-handling-server" : [
                  "172.30.103.190"
                ],
                "x-found-handling-cluster" : [
                  "2d96067f485b4a1098f709587e289cbe"
                ],
                "x-found-handling-instance" : [
                  "instance-0000000012"
                ]
              },
              "body" : """{"_index":"decaf-watcher","_type":"watcher","_id":"monitor-by-system","_version":124,"result":"updated","_shards":{"total":2,"successful":2,"failed":0},"_seq_no":18214,"_primary_term":1}"""
            }
          }

But the document view will be some thing like this

{
   "_index":"decaf-watcher",
   "_type":"watcher",
   "_id":"monitor-by-system",
   "_version":127,
   "found":true,
   "_source":{
      "_doc":[
         {
            "issue":"issue1",
            "@timestamp":"2019-11-13T09:03:36.848704Z",
            "element":"ABC123"
         },
         {
            "issue":"issue2",
            "@timestamp":"2019-11-13T09:03:36.848704Z",
            "element":"ABC456"
         }
      ]
   }
}
2

you need to send a bulk request then with new line delimited JSON instead of a single JSON document.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.