# Using slack to show latest error message by domain

**URL:** <https://discuss.elastic.co/t/using-slack-to-show-latest-error-message-by-domain/187777>\
**Category:** Elasticsearch\
**Created:** [June 27, 2019, 8:11am UTC](https://discuss.elastic.co/t/using-slack-to-show-latest-error-message-by-domain/187777 "2019-06-27T08:11:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![PeterV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/peterv/32/45100_2.png) [@PeterV](https://discuss.elastic.co/u/PeterV)\
**Post date:** [June 27, 2019, 8:11am UTC](https://discuss.elastic.co/t/using-slack-to-show-latest-error-message-by-domain/187777/1 "2019-06-27T08:11:14Z")

</div>

Hello there!

We are currently using Elasticsearch in combination with Kibana and Filebeat to report errors to Slack. This is working perfectly but we would like to show the latest 5 errors in that same Slack message.

This is currently my working watcher (i cant wrap the watcher below into code, weird, the editor does not work):  
{  
"trigger": {  
"schedule": {  
"interval": "1m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"log\*"  
],  
"types": ,  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"must": [  
{  
"range": {  
"@timestamp": {  
"gte": "now-1m",  
"lte": "now"  
}  
}  
},  
{  
"match": {  
"severity": "ERROR"  
}  
}  
]  
}  
},  
"aggs": {  
"group\_by\_domain": {  
"terms": {  
"field": "domain.keyword",  
"size": 1  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gte": 1  
}  
}  
},  
"actions": {  
"notify-slack": {  
"throttle\_period\_in\_millis": 300000,  
"slack": {  
"account": "",  
"message": {  
"from": "{{#ctx.payload.aggregations.group\_by\_domain.buckets}}{{key}}{{/ctx.payload.aggregations.group\_by\_domain.buckets}}",  
"to": [  
"#channelname",  
"@channel"  
],  
"text": "ERROR - Application Errors.",  
"attachments": [  
{  
"color": "danger",  
"title": "Let op!",  
"text": "Error occoured for domain {{#ctx.payload.aggregations.group\_by\_domain.buckets}}{{key}} ({{doc\_count}} errors) {{/ctx.payload.aggregations.group\_by\_domain.buckets}}! Check {{#ctx.payload.aggregations.group\_by\_domain.buckets}}{{key}}{{/ctx.payload.aggregations.group\_by\_domain.buckets}} for more information."  
}  
]  
}  
}  
}  
}  
}

It shows the amount of errors by domain in the last 1 minute, and it is working prefectly!

But now i want to expand this message by including the last 5 errors in the slack message so the developer can check it without opening kibana first. I have modified the watcher by adding an aggegration:

```
"group_by_message": {
              "terms": {
                "field": "message.keyword",
                "size": 5
              }
            }

```

And adding the group by message to the slack attachement:  
`\n{{#ctx.payload.aggregations.group_by_message.buckets}}{{key}}\n\n\n{{/ctx.payload.aggregations.group_by_message.buckets}}\n`

This does work, sometimes. Sometimes the variables are just empty, and i am unable to find out what is causing this to be empty. If i simulate the watcher, the body is also sometimes filled with the error message.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2019, 8:11am UTC](https://discuss.elastic.co/t/using-slack-to-show-latest-error-message-by-domain/187777/2 "2019-07-25T08:11:17Z")

</div>

Closed on July 25, 2019, 8:11am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.