Slack Integration with ELK stack

Elastic Stack Elasticsearch
1

Hi

I have installed the ELK Stack 8.9.0 in AWS Ubuntu Instance. I was configured the elk stack and it's working fine. So, I want to integrate the slack with elk stack and send the alert to slack channel if any 500 status code occurs in the apache logs.

I configured the filebeat in apache server and enabled and configured the apache module.

2

Hi experts,

Can anyone let me know regarding the slack configuration. I was running my elk stack in EC2 instance.

I tried to add the below code to kibana.yml for adding the slack connector as per the document, but it's not working..

xpack.actions.preconfigured:
  my-slack:
    name: preconfigured-slack-webhook-connector-type
    actionTypeId: .slack
    secrets:
      webhookUrl: 'https://hooks.slack.com/services/xxxx/xxxx/xxxx'

Thanks in advance.

3

Hi

Is anyone configured like this?

4

Do you have any error? What do you have in Kibana logs? What is not working?

Also, do you have a paid license? The Slack webhook needs a paid license.

5

Yes, I have the logs in kibana. My apache, haproxy, cakephp and other services logs are maintaining in kibana. The flow is filebeat-logstash-elasticsearch-kibana.
This is working fine.
What i need is i want to integrate the my slack webhook with this. So that i can receive the alert.
Am i configured the elk stack in aws ec2 ubuntu instance.
I don't have any license for elk stack.

6

The webhook won't work on the Basic Free license.

The only connectors that work with the Basic Free license are the index connector and the server log connector.

7

Okay. Actually In my 1st post i followed the official document to add the slack connector. But it's not working.

Can you please tell me how to add the slack connector and where to add this.

8

There is not much to configure besides what you already did, it is exactly as explained in the documentation, you just need to change the value of the webhookUrl.

But as already mentioned this connector needs a paid license, it won't work without it.

If you do not have a paid license you nee to be using the trial license, which has a duration of 30 days, if you want to test it.

9

Okay. Thank you so much for the response.

10

@leandrojmp

Can you clarify this one doubt, Am I running this elk stack in my aws ec2 Ubuntu as a on-premise. I didn't used any elk stack cloud.

So is on-premise also have the paid license. If yes, could you please share the on-premise setup with license documentation.

Thanks.

11

License is paid you would need to contact sales

You can try a 30 Day Trial

Kibana - Stack Management - License
And enable the Trial License

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.