Hi Elastic team I have watcher data from search from indices and then make text for post into ms team channel but i can not send text value into ms team channel it's error: "Newtonsoft.Json.JsonReaderException: After parsing a value an unexpected character was encountered: T. Path 'text', line 2, position 23."
this Watch JSON
{
"trigger": {
"schedule": {
"daily": {
"at": [
"06:00"
]
}
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"xxxx-storehealth-log*"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"must": [
{
"query_string": {
"query": """
TERMINAL_TYPE.keyword : "POS" and STORE_ID : * and PARTITION_SPACE_GB.DRIVE.keyword : "C:" and PARTITION_SPACE_GB.SPACE <2 """
}
}
],
"filter": {
"range": {
"@timestamp": {
"time_zone": "+07:00",
"gte": "now/d-7d",
"lt": "now/m-60m"
}
}
}
}
},
"aggs": {
"xxxx": {
"multi_terms": {
"terms": [
{
"field": "STORE_ID.keyword"
},
{
"field": "TERMINAL_NO.keyword"
},
{
"field": "TERMINAL_TYPE.keyword"
},
{
"field": "TERMINAL_NAME.keyword"
}
],
"size": 10
}
}
},
"_source": [
"STORE_ID",
"TERMINAL_NO",
"TERMINAL_TYPE",
"TERMINAL_NAME",
"@timestamp"
]
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 0
}
}
},
"actions": {
"MS_Teams": {
"transform": {
"script": {
"source": """
ctx.payload.xxxx = ctx.payload.aggregations.xxxx.buckets.stream().map(p ->
'{"TERMINAL_NAME": "'+p.key[3]+'"}'
).collect(Collectors.toList())
""",
"lang": "painless"
}
},
"foreach": "ctx.payload.xxxx",
"max_iterations": 100,
"webhook": {
"scheme": "https",
"host": "xxxx.webhook.office.com",
"port": 443,
"method": "post",
"path": "/webhookb2/xxxx",
"params": {},
"headers": {
"Content-Type": "application/json"
},
"body": """{ "text": " ==========1
The watcher:*{{ctx.payload}}* in env:*{{ctx.payload}}* found that the process *{{ctx.payload}}* has been utilizing CPU over 95% for the past 1 hr on node:
{{#ctx.payload.nodes}} {{.}}
{{/ctx.payload.nodes}}
The runbook entry is here: *{{ctx.payload}}* "}"""
}
}
},
"metadata": {
"service": {
"name": "xxxxxxxx"
}
}
}