Status Failure for Slack | Watcher

Elastic Stack Elasticsearch
1

Hi,

My slack message is failing and I was hoping someone could help me with figuring out why.

// Action statement thus far

  "actions": {
    "notify-slack": {
      "throttle_period": "5m",
      "slack": {
        "message": {
          "from": "Alert",
          "to": [
            "#alert-test-channel"
          ],
          "text": """
  {{#ctx.payload.array_new}}
  {{key}} has not been sent logs in the last 5 minutes (facepalm).
  {{/ctx.payload.array_new}}
  """
        }
      }
    }
  }
}

// Executed output (from action onwards)

"actions" : [
    {
      "id" : "notify-slack",
      "type" : "slack",
      "status" : "failure",
      "slack" : {
        "account" : "monitoring",
        "sent_messages" : [
          {
            "status" : "failure",
            "request" : {
              "host" : "hooks.slack.com",
              "port" : -1,
              "scheme" : "https",
              "method" : "post",
              "headers" : {
                "Content-Type" : "application/json; charset=UTF-8"
              },
              "body" : """{"channel":"#alert-test-channel","username":"Alert","text":"  EXPO has not been sent logs in the last 5 minutes (facepalm).\n"}"""
            },
            "response" : {
              "status" : 403,
              "headers" : {
                "x-amz-cf-pop" : [
                  "FJR50-C1"
                ],
                "date" : [
                  "Wed, 21 Aug 2019 10:28:11 GMT"
                ],
                "server" : [
                  "Apache"
                ],
                "transfer-encoding" : [
                  "chunked"
                ],
                "vary" : [
                  "Accept-Encoding"
                ],
                "x-frame-options" : [
                  "SAMEORIGIN"
                ],
                "x-via" : [
                  "haproxy-www-w230"
                ],
                "strict-transport-security" : [
                  "max-age=31536000; includeSubDomains; preload"
                ],
                "via" : [
                  "1.1 fea27bc7c6b866014db45f720775ef94.cloudfront.net (CloudFront)"
                ],
                "access-control-allow-origin" : [
                  "*"
                ],
                "referrer-policy" : [
                  "no-referrer"
                ],
                "connection" : [
                  "keep-alive"
                ],
                "content-type" : [
                  "text/html"
                ],
                "x-cache" : [
                  "Error from cloudfront"
                ],
                "x-amz-cf-id" : [
                  "O8L115hV90-tuaPWh0GgqeEaiAZK0kVT4THAxbENOgwfx7SpGZ-7ZQ=="
                ]
              },
              "body" : "invalid_token"
            },
            "to" : "#alert-test-channel",
            "message" : {
              "from" : "Alert",
              "text" : "  EXPO has not been sent logs in the last 5 minutes (facepalm).\n"
            }
          }
        ]
      }
    }
  ]
},
"messages" : [ ]
  }
}

Thank you in advance :slight_smile:

2

I've changed the action a bit, however, I am still getting the same error message

// Action

  "actions": {
    "notify-slack": {
      "throttle_period": "5m",
      "slack": {
        "message": {
          "from": "Alert",
          "to": [
            "#alert-test-channel"
          ],
          "text": "Alert:\n{{#ctx.payload.array_new}}\"{{key}}\" has not been sent any logs in the past 5 minutes.\n\n{{/ctx.payload.array_new}}"
        }
      }
    }
  }
}
3

Found the solution

I had to reset my webhook url

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.