Reporting email action failure from watcher - ELK7.8

[jancodenew (jan)]

Hi Team,

Please help me to resolve the email action failure error mentioned below from watcher. I am using ELK version 7.8.

"id": "email_action",
"type": "email",
"status": "failure",
"error": {
"root_cause": [
{
"type": "exception",
"reason": "Watch[6d38b55a-6e4b-498f-869f-0171675c02fc] reporting[xxx-xxx_xxxx.csv] Error when polling pdf from host[kibana.XXXXXX.com], port[443], method[POST], path[/api/reporting/generate/csv], status[500], body[{"message":"Reporting generation failed","reason":"Error: Request Timeout after 30000ms"}]"

[jancodenew (jan)]

@Frank_Hassanabad
Could you please help with the above issue ?

[spong (Garrett)]

Hey there @jancodenew

Watcher here isn't specific to Elastic Security/SIEM, so I've added the stack-alerting and stack-reporting tags for additional visibility. It's worth sorting through a few of those topics as some seem pretty relevant.

Based on

body[{"message":"Reporting generation failed","reason":"Error: Request Timeout after 30000ms"}]"

It's sounding like your report gen is timing out, so that's a good place to start. You can either try increasing the timeout, or debugging around your report generation to see why it might be timing out. Once resolved if you're still having issues, the watcher email action docs are probably the next best source, but please feel free to report back with additional details as someone may be able to provide more details from there. Hope this helps!