Markdown in Watcher Slack Action attachements

Elastic Stack Elasticsearch
1

Hello,

I'm configuring my X-Pack to send me Slack messages when I log an error in ES. The trick is I'd like to have the stacktrace formatted as a code block so I tried this

"notify_slack": {
      "slack": {
        "message": {
          "to": "@me",
          "text": "Proxy monitoring",
          "attachments" : [
            {
              "mrkdwn_in": ["text"],
              "title" : "Errors Found",
              "text" : "Encountered  {{ctx.payload.hits.total}} errors in the last minute :scream:\n```\n{{ctx.payload.hits.hits.0._source.err.stack}}\n```",
              "color" : "danger"
            }
          ]
        }
      }
    }

I added the mrkdwn_in because I saw in Slack documentation that this is needed to apply markdown on attachment.

Unfortunately, this doesn't please X-Pack API:

{
    "error": {
        "root_cause": [
            {
                "type": "parse_exception",
                "reason": "could not parse message attachment field. unexpected field [mrkdwn_in]"
            }
        ],
        "type": "parse_exception",
        "reason": "failed to parse [slack] action [error/notify_slack]. failed to parse [message] field",
        "caused_by": {
            "type": "parse_exception",
            "reason": "could not parse slack message. failed to parse [attachments] field.",
            "caused_by": {
                "type": "parse_exception",
                "reason": "could not parse message attachment field. unexpected field [mrkdwn_in]"
            }
        }
    },
    "status": 400
}

Is there a way to make it acceptable or should I forget formatting my attachments?

Thank you

1 Like
2

Hey,

indeed this is currently not supported. I created an issue, so we fix it on the x-pack side.

--Alex

3

Thank you @spinscale!

Could you point me to this issue, or leave a message here when it's fixed so I could be alerted?

4

Hey,

that's internal unfortunately. I'll try to ping here when we fix it.

--Alex

5

I understand :slight_smile:!

Thanks a lot

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.