List of all ctx.* / context.* I can use in a Kibana webhook payload?

[Sandra_Schlichting]

Dear all =)

Does anyone know if there exist a list of all the info I can include in a Kibana rule/webhook payload?

Right now I have

 "watch_id":"{{ctx.watch_id}}",
 "id":"{{ctx.id}}",
 "payload":"{{ctx.payload}}",
 "execution_time":"{{ctx.execution_time}}",
 "date":"{{context.date}}",
 "alert_id":"{{alert.id}}",
 "alert_id2":"{{alertId}}",
 "count":"{{ctx.payload.hits.total}}",
 "condition_matched_documents":"{{context.value}}",
 "condition_description":"{{context.conditions}}"

where some of them seam to be Elastic specific, as they always are empty.

So I would be very interested in knowing what goodies I can include in Kibana webhook payloads =)

Hugs,
Sandra =)

[Patrick_Mueller (Patrick Mueller (Kibana Alerting))]

This seems like a mixture of Watcher context variables, and Kibana Alerting context variables. Watcher and Kibana Alerting not related in anyway, but have some similarities, such as calling these variables (generally) context variables. For watcher, they generally start with {{ctx.***}} and for Kibana Alerting, they start with {{context.***}}.

For Kibana alerting, the context variables depend on the alerting rule type itself. For instance, here's a list of variables made available by the index threshold alerting rule type: Index threshold | Kibana Guide [7.13] | Elastic

Kibana alerting also has some variables that can be used with any alerting rule type: Defining rules | Kibana Guide [7.13] | Elastic

[Sandra_Schlichting]

Thanks a lot Patrick! That was exactly what I was looking for =)

Hugs,
Sandra =)