Two different email IDs with two different BODY in a single watcher code

Hi All,

I want to send alert to two different email ids with two different text as a BODY from a single watcher code. so basically email id one will receive full customer details and email id two will get only limited info about customer details.
I can achieve this same by creating two different watchers but I don't want to do this.
I have created sample watcher code and put it in kibana watcher. But somehow the alert is not fired. Could someone please guide whether i am rite or wrong.

 {
  "trigger": {
    "schedule": {
      "interval": "15m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "bookmark-*"
        ],
        "types": [],
        "body": {
          "query": {
            "bool": {
              "must": {
                "range": {
                  "@timestamp": {
                    "from": "now-15m",
                    "to": "now"
                  }
                }
              },
              "should": [
                {
                  "wildcard": {
                    "kubernetes.node.name": "ost-testenv-sub*"
                  }
                }
              ],
              "minimum_should_match": "1"
            }
          },
          "aggs": {
            "nodes": {
              "terms": {
                "field": "kubernetes.node.name",
                "size": 5000,
                "order": {
                  "pods": "desc"
                }
              },
              "aggs": {
                "pods": {
                  "cardinality": {
                    "field": "kubernetes.pod.ip"
                  }
                },
                "pod_limits": {
                  "max": {
                    "field": "kubernetes.node.pod.allocatable.total"
                  }
                },
                "node_count": {
                  "cardinality": {
                    "field": "kubernetes.node.name"
                  }
                }
              }
            },
            "max_pods_per_node": {
              "avg_bucket": {
                "buckets_path": "nodes>pod_limits"
              }
            },
            "total_scheduled_pods": {
              "sum_bucket": {
                "buckets_path": "nodes>pods"
              }
            },
            "total_node_count": {
              "sum_bucket": {
                "buckets_path": "nodes>node_count"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "always": {}
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "to": [
          "sai.xxxxxxx@gmail.com"
        ],
        "subject": "TESTING - customer details",
        "body": {
          "text": "we wont hide anything here, basically customer full details"
        }
      }
    },
    "send_email_pd": {
      "email": {
        "profile": "standard",
        "to": [
          "mgbsk@bsk.pagerduty.com"
        ],
        "subject": "TESTING - limited customer details",
        "body": {
          "text": "we will hide some details here"
        }
      }
    }
  },
  "metadata": {
    "_cne-alertType": "logging",
    "_cne-envType": "dev",
    "_cne-alertSeverity": "critical",
    "_cne_alertSeverity": "critical",
    "_cne_stackName": "testenv",
    "_cne_alertType": "logging",
    "_cne-stackName": "simple",
    "_cne_envType": "dev",
    "_cne_costCenter": "test",
    "_cne-project": "toit-mg",
    "_cne-costCenter": "toit",
    "_cne_project": "toit-mg"
  },
  "transform": {
    "script": {
      "source": "def formatter = NumberFormat.getNumberInstance(); return ['total_nodes': formatter.format(ctx.payload.aggregations.total_node_count.value), 'total_pods': formatter.format(ctx.payload.aggregations.total_scheduled_pods.value), 'allocatable_pods_per_node': formatter.format(ctx.payload.aggregations.max_pods_per_node.value)]",
      "lang": "painless"
    }
  }
}

You can use the Execute Watch API to execute a watch and check it's execution states and figure out why it is not firing. Feel free to share the output here.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.