Watcher email body message to send some parameters in anomaly explorer

Elastic Stack Kibana
,
1

Hi Team,
i need to send email to the customer any anomaly reaches 75% above critical.
in email body included parameters like ("job id, actual,typical values and probability ,anomaly score , influencers ")shown in image marked as highligher with respective values. how to fetch those values in email body message in watcher alert creation .

please help me .

sample
sample1748×861 80.8 KB

2

In meassge body include the anomaly values and parameters like “job id ,job name,time,url,actual& typical values , influencer values” and sent to the customer.
How the anomaly explorer shows the details in screen shot highligted in yellow same structure we need in the alert email message body .

Could you please help us.

3

Here is an example you could use as a model for what you want to do:

4

how to get specific actual & typical values shown in screenshot get into message body .. how to declare or specify in html or any {ctx.payload. aggregations .actual.values .count } type update me .

thanks in advance

5

The example I posted shows you one way of doing it - using a transform block to extract the actual and typical out of the ctx.payload.hits.hits array and storing them as a new data structure called ctx.payload._value - which is then accessed via mustache syntax in the logging section.

Was that not clear?

6

i need to do the specific single job anomalies have above 75% to send the Email (include message body the parameters job id, time, actual,typical value,probability score values ).but automatic email alert i get the anomaly score ,buckets score ,link ,job id ,time .

so , i need to get actual,typical value,probability score values using any method . i mention in my email message body.

7

Again - look at the example I provided here: https://gist.github.com/richcollier/1c2b8161286bdca6c553859f28d3d66d

You can see exactly where I grab the actual and typical

image
image972×709 67 KB

and then reference it later in the logging section (or in your case the email section) so that the output looks like:

Anomalies:
==========
time=2017-02-09T16:00:00.000Z 
airline=AAL 
score=99 (out of 100) 
responsetime=242ms (typical=100ms)
link= http://localhost:5601/...
...