Stack Monitoring Alerts Disk Usage, how to get the node name only?

[leandrojmp (Leandro Pereira)]

Hello,

I'm using the built-in Disk Usage rule in Kibana Alert on my monitoring cluster to alert me when a node reaches more than 94% of disk usage (I've changed my watermarks), this works fine, but now I need to send those alerts to slack and I'm trying to get only the node name to use on the slack webhook payload, but the variable context.node gives me the node name and the disk usage percent, which I do not want.

I'm using these two context variables.

I would expect the context.node would give me the node name, and context.state the current state of the alert, but using context.node gives me the node name followed by the disk usage percent in the following format:

node-name:95

Is there any way to get only the node name? Should I open an issue to fix this?

My monitoring cluster is on 8.8.0.

[leandrojmp (Leandro Pereira)]

Well, aparently there is no way to get just the node name.

Looking at the content of the context field, these are the fields available:

{
  "internalShortMessage": "Disk usage alert is firing for node nodeName-06 in cluster: clusterName. Verify disk usage level of node.",
  "internalFullMessage": "Disk usage alert is firing for node nodeName-06 in cluster: clusterName. [View node](/app/monitoring#/elasticsearch/nodes/redactedNodeId?_g=(cluster_uuid:redactedClusterId))",
  "state": "firing",
  "nodes": "nodeName-06:96",
  "count": 1,
  "node": "nodeName-06:96",
  "clusterName": "clusterName",
  "action": "[View node](/app/monitoring#/elasticsearch/nodes/redactedNodeId?_g=(cluster_uuid:redactedClusterId))",
  "actionPlain": "Verify disk usage level of node."
}

The context.node should be split in two fields, context.node with the node name and context.diskUsage with the disk percent used.

I will open an issue in github.

[leandrojmp (Leandro Pereira)]

Opened this issue on Github.