`.
#cloud.auth:
#================================ Outputs =====================================
# Configure what output to use when sending the data collected by the beat.
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["172.25.11.124:9204"]
# Enabled ilm (beta) to use index lifecycle management instead daily indices.
#ilm.enabled: false
# Optional protocol and basic auth credentials.
#protocol: "https"
username: "elastic"
password: "password"
#----------------------------- Logstash output --------------------------------
#output.logstash:
# The Logstash hosts
#hosts: ["localhost:5044"]
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate\_authorities: ["/etc/pki/root/ca.pem"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
#================================ Processors =====================================
# Configure processors to enhance or manipulate events generated by the beat.
processors:
- add\_host\_metadata: ~
- add\_cloud\_metadata: ~
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["\*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["\*"]
#============================== Xpack Monitoring ===============================
# heartbeat can export internal metrics to a central Elasticsearch monitoring
# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
# reporting is disabled by default.
# Set to true to enable the monitoring reporter.
#xpack.monitoring.enabled: false
# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch output are accepted here as well. Any setting that is not set is
# automatically inherited from the Elasticsearch output configuration, so if you
# have the Elasticsearch output configured, you can simply uncomment the
# following line.
#xpack.monitoring.elasticsearch:`Preformatted text`
```
PUT _xpack/watcher/watch/my-watch1
```
{
"trigger" : {
"schedule" : { "cron" : "0 0/1 \* \* \* ?" }
},
"input" : {
"search" : {
"request" : {
"indices" : [
"heartbeat-\*"
],
"body" : {
"query" : {
"bool" : {
"must": [
{
"term": {
"monitor.status": {
"value": "down"
}
}
}
],
"filter" : {
"range": {
"@timestamp": {
"from": "{{ctx.trigger.scheduled\_time}}||-5m",
"to": "{{ctx.trigger.triggered\_time}}"
}
}
}
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"email\_admin" : {
"email" : {
"to" : "vishnumk@nseit.com",
"subject" : "down",
"body" : "{{ctx.payload.http.url}}"
}
}
}
}`
I am receiving the mail when portal is down but im not receiving the http.url field from heartbeat index in my mail
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 8, 2019, 7:25am UTC](https://discuss.elastic.co/t/unable-to-include-fields-present-in-index-while-using-email-action-in-watcher/179975/2 "2019-05-08T07:25:57Z")
Hey,
please format your posts properly, you can use markdown code formatting in here - which makes your posts a million times easier to read, which in turn increases the likelihood of getting an answer. Thank you!
Also, I highly encourage you to read this [blog post](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches) about debugging watches, as it will likely reduce the time you spent on debugging.
Lastly, the payload you are receiving looks **exactly** like a search request, which means that the data about single hits is included in `ctx.payload.hits.hits` array. Just execute that search via the dev tools console and see how the search response data structure looks like.
Hope this helps!
--Alex
---
### Author:  [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [May 8, 2019, 12:59pm UTC](https://discuss.elastic.co/t/unable-to-include-fields-present-in-index-while-using-email-action-in-watcher/179975/3 "2019-05-08T12:59:23Z")
"hits" : {
"hits" : [
{
"\_index" : "heartbeat-6.7.0-2019.05.08",
"\_type" : "doc",
"\_source" : {
"tcp" : {
"port" : 8081
},
"@timestamp" : "2019-05-08T12:49:43.243Z",
"beat" : {
"hostname" : "dbserver1",
"name" : "dbserver1",
"version" : "6.7.0"
},
"host" : {
"os" : {
"codename" : "Core",
"name" : "CentOS Linux",
"family" : "redhat",
"version" : "7 (Core)",
"platform" : "centos"
},
"containerized" : true,
"name" : "dbserver1",
"id" : "40adb1a64eaa4d0cb8f9c45422250ca2",
"architecture" : "x86\_64"
},
"http" : {
"url" : "[http://172.25.19.101:8081/TNPCB/](http://172.25.19.101:8081/TNPCB/)"
},
"monitor" : {
"duration" : {
"us" : 16000287
},
"scheme" : "http",
"ip" : "172.25.19.101",
"name" : "http",
"id" : "http@[http://172.25.19.101:8081/TNPCB/](http://172.25.19.101:8081/TNPCB/)",
"type" : "http",
"status" : "down"
},
"event" : {
"dataset" : "uptime"
},
Please help me out how can i get my http.url field
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 5, 2019, 12:59pm UTC](https://discuss.elastic.co/t/unable-to-include-fields-present-in-index-while-using-email-action-in-watcher/179975/4 "2019-06-05T12:59:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.