Need to get website hosted on a server as watcher result

Hi, I have 3 websites hosted on my server, my query is , is there any way to get website name when watcher execute. Now I am getting hostname in subject line.
{
"trigger": {
"schedule": {
"interval": "10s"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"heartbeat-xyz-*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"term": {
"monitor.status": {
"value": "down"
}
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"from": "now-10s"
}
}
}
]
}
},
"aggregations": {
"by_monitors": {
"terms": {
"field": "beat.hostname",
"size": 100,
"min_doc_count": 1
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"email_1": {
"email": {
"account": "gmail_account",
"profile": "gmail",
"to": [
"xyz@gmail.com"
],
"subject": "Alert! SERVER IS DOWN !!",
"body": {
"html": "{{ctx.payload.hits.total}} Server has stopped working:

{{#ctx.payload.aggregations.by_monitors.buckets}}{{key}}
{{/ctx.payload.aggregations.by_monitors.buckets}} \t \n\n at times: {{ctx.trigger.triggered_time}} \n\n"
}
}
}
}
}

Hey,

have you taken a look at the metricbeat data, when configured a HTTP check? As you do configure url to connect to, you implicitely configure different websites. Check the http.url field of those documents.

--Alex

hi, I got the solution. Just need to add "Monitor.ID" in term field. It is now showing me the website name which is down.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.