Issue with contextlink value for alerts

Elastic Stack Elasticsearch
1

Hello,
We've been having an issue where our context.link in staging displays the wrong value for our alerts. In dev it shows the correct url like elk-dev.company.com but in staging it shows company-elk-staging.kb.westeurope.azure.elastic-cloud.com:9243
How can this context.link value be changed?

image
image470×393 16.7 KB

Thanks in advance :slight_smile:

2

Hi @MarioCDS Welcome to the community...

Concerning you issues the dev endpoint looks like a self managed cluster and the staging looks like and Elastic Cloud Hosted deployment that context is pulled from the underlying meta data

What version are you on and are you running different types of deployments?

Note: Seems like you perhaps tried to post this a couple time but since you are a new user the bot sees those links as attempted spam.

1 Like
3

Hey @stephenb , thanks for the answer, I am running both on version 8.6.1, from what I can see both staging and dev environment have build_type: "docker".
Is there any way I can change this "context.link" property?

4

Any help on this?

5

I asked a question whether one was running in elastic cloud and the other was running self-managed on-prem
The build type of docker is not what matters. It's the URL which you access them by?

And of course you can put any value you like in hard-coded. But no, I don't think those contact links can be changed

That looks like elastic Cloud to me
company-elk-staging.kb.westeurope.azure.elastic-cloud.com:9243

6

When I ping the URLs both return the same IP and DNS, which makes me think they're both hosted on cloud
"k8s-infra-01-public-companyname.westeurope.cloudapp.azure"

Also the real issue is that when I press the link from alerts built in staging "company-elk-staging.kb.westeurope.azure.elastic-cloud:9243" it fails with the below error, which forces me to manually replace the URL with elk-staging.company

image
image487×589 23.6 KB

7

Sorry I'm confused. I have lost track of what the actual URL

I don't know what that is....

The IP is most likely the proxy endpoint for elastic cloud which then gets translated.

Also, you'll always have to authenticate that's not going to happen automatically from an alert from like an email or something.

I'm not sure I can help because I don't have enough information.... I suspect you created an alias for your elastic cloud, although I think that should still work.

I will test when I get a chance with my elastic Cloud deployment and see what the context link is

Perhaps you should open a support ticket.