# Pagerduty action not working using watcher

**URL:** https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [October 9, 2019, 10:12am UTC](https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811 "2019-10-09T10:12:51Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Sumit\_Kumar1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumit_kumar1/32/43471_2.png) [@Sumit\_Kumar1](https://discuss.elastic.co/u/Sumit_Kumar1)
#### Post date: [October 9, 2019, 10:12am UTC](https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811/1 "2019-10-09T10:12:51Z")

</div>

Pagerduty action not working using watcher

---

<div class="post-metadata">

### Author: ![Sumit\_Kumar1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumit_kumar1/32/43471_2.png) [@Sumit\_Kumar1](https://discuss.elastic.co/u/Sumit_Kumar1)
#### Post date: [October 9, 2019, 10:13am UTC](https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811/2 "2019-10-09T10:13:51Z")

</div>

My watch -

{  
"trigger": {  
"schedule": {  
"interval": "1m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"xg\_elastalert\_status\_write\_error"  
],  
"types": ,  
"body": {  
"query": {  
"bool": {  
"must": [  
{  
"bool": {  
"should": [  
{  
"match": {  
"\_type": "elastalert\_error"  
}  
}  
]  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-100h"  
}  
}  
}  
]  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},  
"actions": {  
"send\_email": {  
"email": {  
"profile": "standard",  
"to": [  
"sumitkumar.singh@in.imshealth.com"  
],  
"subject": "Elastalert Failure {{ctx.payload.hits.hits.0.\_source.@timestamp}}",  
"body": {  
"text": "Failure Message : {{ctx.payload.hits.hits.0.\_source.message}}\n Message: {{ctx.payload.hits.hits.0.\_source.message}}\n"  
}  
}  
},  
"notify-pagerduty" : {  
"throttle\_period" : "5m",  
"pagerduty" : {  
"incident\_key": "a6bfd96dbf0b4e8393697c11b0954a",  
"description" : "Main system down, please check!"  
}  
}  
}  
}

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 9, 2019, 1:11pm UTC](https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811/3 "2019-10-09T13:11:18Z")

</div>

please take your time and properly format your message. This forum supports markdown, so JSON should be put into code snippets, as this will make everything much more readable.

Can you share the output of the execute watch API or of the watch history from a run of that watch? So we can see, what happened with the pagerduty action.

---

<div class="post-metadata">

### Author: ![Sumit\_Kumar1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumit_kumar1/32/43471_2.png) [@Sumit\_Kumar1](https://discuss.elastic.co/u/Sumit_Kumar1)
#### Post date: [October 10, 2019, 9:44am UTC](https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811/5 "2019-10-10T09:44:28Z")

</div>

```
   {
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"xg_elastalert_status_write_error"
],
"types": ,
"body": {
"query": {
"bool": {
"must": [
{
"bool": {
"should": [
{
"match": {
"_type": "elastalert_error"
}
}
]
}
},
{
"range": {
"@timestamp": {
"gte": "now-100h"
}
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"sumitkumar.singh@in.imshealth.com"
],
"subject": "Elastalert Failure {{ctx.payload.hits.hits.0._source.@timestamp}}",
"body": {
"text": "Failure Message : {{ctx.payload.hits.hits.0._source.message}}\n Message: {{ctx.payload.hits.hits.0._source.message}}\n"
}
}
},
"notify-pagerduty" : {
"throttle_period" : "5m",
"pagerduty" : {
"incident_key": "a6bfd96dbf0b4e8393697c11b0954a",
"description" : "Main system down, please check!"
}
}
}
}
```

---

<div class="post-metadata">

### Author: ![Sumit\_Kumar1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumit_kumar1/32/43471_2.png) [@Sumit\_Kumar1](https://discuss.elastic.co/u/Sumit_Kumar1)
#### Post date: [October 10, 2019, 10:25am UTC](https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811/6 "2019-10-10T10:25:13Z")

</div>

Hi [Alexander Reelsen](https://discuss.elastic.co/u/spinscale)

I wanted to know about the configurations for pagerduty action using xpack watcher . I checked and found that it requires account that stores service\_api\_key in elasticsearch.yml . So, can't we directly use service\_api\_key in watcher config ? If you have any sample for pager duty action xpack watcher please do share .

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 11, 2019, 12:39pm UTC](https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811/7 "2019-10-11T12:39:13Z")

</div>

the `service_api_key` setting should be stored in a keystore. See [https://www.elastic.co/guide/en/elasticsearch/reference/7.4/actions-pagerduty.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/actions-pagerduty.html)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 8, 2019, 12:39pm UTC](https://discuss.elastic.co/t/pagerduty-action-not-working-using-watcher/202811/8 "2019-11-08T12:39:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
