Unable to send slack notification through x-pack on ELK 5.5 - Need Help


(Sandeep Gawali) #1

Hello,

I have been trying to send x-pack slack notification but keep failing - i amnot sure what wrong I am doing here ... below is my x-pack slack configuration in elasticsearch.yml file. Kindly Help me to troubleshoot and setup email slack notification.

==========================
#Xpack
action.auto_create_index: .security,.monitoring*,.watches,.triggered_watches,.watcher-history*
xpack.notification.slack.default_account:
url: https://hooks.slack.com/services/dhw65jnduedu/08hbdhyj092hLhjpedko/
message_defaults:
from: watcher

watcher.actions.email.service.account:
standard_account:
profile: standard
smtp:
host: mta41r1.sl.emptoris.com
port: 25

"actions": {
"email_administrator": {
"email": {
"from": "admin@123.com",
"to": "admin@123-engage.slack.com",
"subject": "Counts of error code is {{ctx.payload.hits.total}}",
"body": "There are total {{401 Unauthorized}} error codes found at {{ctx.execution_time}}",
"priority": "high"

}

}
}
xpack.watcher.index.rest.direct_access: true
http.cors.enabled: true
http.cors.allow-origin: http://localhost:5601
xpack.watcher.execution.default_throttle_period: 10m
script.engine.groovy.inline.elasticsearch-watcher-watch: on

"actions": {
"my_webhook": {
"throttle_period": "2m",
"webhook": {
"method": "POST",
"host": "localhost",
"port": 9200,
"path": ":/{{ctx.watch_id}",
"body": "{{ctx.watch_id}}:{{ctx.payload.hits.total}}"

}

}
}

==========================

Thanks,
Sandeep


(Alexander Reelsen) #2

please take the time for format your messages properly, this is is hard to read. You can use special tags to paste snippets, see this markdown help - I am unable to identify what is the watch in your post and what is configuration.

Also, just pasting the watch is not very helpful. Can you paste the result of such an execution of a watch, please?

Just run

POST _xpack/watcher/watch/THE_NAME_OF_YOUR_WATCH/_execute

and paste the output in a gist and link to that gist here.

Thanks


(Sandeep Gawali) #3

Soryy for the delay in response. I will share the output and details with you soon.

Thanks,
Sandeep


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.