Unable to parse watcher payload field which contains a json

Elastic Stack Kibana
1

Hello,
I have a watcher that works perfectly fine and when executed I get an email in html format listing basic string and numeric fields I chose to select from a hit. I use a webhook action to email the results. Now, I want to extract another field, however, its value is a json and for the life of me I cannot figure out how to. I get an error when I simulate within execute mode for my webhook action.

"body": "{\"statusCode\":400,\"messages\":[\"JSON parse error: Unexpected character ('c' (code 99)): was expecting comma to separate Object entries;

'c' happens to be the first character of the first element inside a json object. When I look at the simulator response I can see that the json is provided as a string and therefore " are escaped with \" , but when it tries to format it for the email body it is expecting straight json.

so, I decided to user "transform" parameter and script it to return the field string replacing \" with " or even just \ with nothing.

"transform" : {
      "script" : "return [ 'requestBody': ctx.payload.hits.hits.0._source.message.ApiData.RequestBody.replace('\\','')]"
  }

but I cannot find the right syntax to properly replace the darn thing. I have tried '\\' and /\/g and I ether ger syntax compile error when simulating or nothing is removed. I can replace any other char withing my message.ApiData.RequestBody field, just not the \ one

it could be something to do with the webhook and the mustache template and I'd be clueless. I know it works groovy if I dont try to extract that field and fails when I do (fails only when I execute the webhook action to get an email) . Actual watcher executes just fine and input looks good.

 "transform" : {
      "script" : "return [ 'requestBody': ctx.payload.hits.hits.0._source.message.ApiData.RequestBody.replace('\\','')]"
  },
  "actions": {
    "notification_webhook": {
      "webhook": {
        "scheme": "http",
        "host": "host.com",
        "port": 80,
        "method": "post",
        "path": "our_notifications_path",
        "params": {},
        "headers": {
          "Content-Type": "application/json"
        },
        "body": {
          "source": {
            "notificationRequest": {
              "email": {
                "to": [
                  "me@me.com"
                ],
                "from": "them@them.com",
                "subject": "I got errors!",
                "text": """I have <b>{{ctx.payload.hits.total}} errors in past 10 minutes.</b>
                <br><br> {{ctx.payload.requestBody}} 
                </b><br>ctx.payload.hits.hits.0._source.@timestamp""",
                "priority": "high"
              }
            }
          },
          "lang": "mustache",
          "options": {
            "content_type": "application/html; charset=UTF-8"
          }
        }
      }
    }
  }

any ideas?

2

Hi,

In your case, the backslash \ is a special character that needs to be escaped.

In your transform script, you're trying to replace the backslash \ with an empty string. However, the backslash itself needs to be escaped, so you should use double backslashes \\ to represent a single backslash.

Regards

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.