Watcher errors on sending report with attachment (Error 500)

Elastic Stack Elasticsearch
1

I use version 5.6.5 of the ELK stack, running under docker.

I have a watch that is supposed to run once per month on the 1st of the month and send an email with a PDF report attached containing stats for the previous month.

When I simulate the watch via the Kibana UI, it works and I receive an email with an attachment that contains the correct dashboard data.

However, when the watch triggers on the 1st of the month, I receive no email and the only log entry I can find is in my kibana.log, telling me "statusCode": 500".

I've diffed the kibana log entries for the successful manual report generation and the failed automagic watcher generation and apart from the status code and time stamp/duration, they are identical.

Where do I go next to try and find out what is causing this 500 error on the automagic run?

I've added the watch config, 200 reponse and 500 response at https://pastebin.com/EL6qZr7E

2

Hey,

each watch run creates a so called watch history entry to check out what happened, you can query for those like this

GET .watcher-history-6-*/_search
{
  "query": {
    "bool": {
      "filter": {
        "term": {
          "watch_id": "YOUR_WATCH_ID"
        }
      }
    }
  }
}

Thanks!

3

Thanks - but that only gives me the same information that's logged with the watch; in this case:

"reason": "Watch[WATCH_ID] attachment[api_metric.pdf] HTTP error status host[kibana], port[5601], method[POST], path[/api/reporting/generate/printablePdf], status[500]"

but I already knew that, it's what made me go look at the kibana log.

4

hey,

I think the PDF link you provided may not be the correct one. The documentation shows a direct link to the dashboard, where as you are calling the generatePDF URL. Can you try to specify the dashboard, like done in the docs linking to the dashboard?

--Alex

5

The URL reported in the error is only the path; the full URL is the one I copied from the Dashboard > Reporting > Generation URL. The rest of the URL is parsed by the watch config and ends up in "params": { "jobParams" } in the config (it's in the pastebin).

The job only errors when it's run by a watch on the timer, when I kick it off manual via Simulate (with identical settings) it works fine.

6

duh. I have misread your initial watch. We changed the mechanism how to retrieve a dashboard a long time ago, from sync to a polling based mechanism.

This also requires you to use the reporting email attachment action. Can you replace the one you are using right now with the reporting one?

https://www.elastic.co/guide/en/x-pack/6.2/actions-email.html#configuring-email-attachments

--Alex

1 Like
7

Yay, that seems to have done the trick - thanks Alex!

1 Like
8

Hey,

great you got it working finally!

Is there anything we can improve our docs on, so that this is more obvious you should use the reporting action for this task? Would love to get some feedback here, so others dont fall into the same trap.

--Alex

9

I'm not 100% sure - I originally set up this watch a good 6 months ago or so. I found an example on the ES docs site and customised that, but I cannot for the life of me find that example again :-/

Probably the easiest way to stop the trap is to add a little validator on the watch save form; make it pop up an error that mentions "Use reporting instead". From there a docs search should've probably seen me sorted :slight_smile:

10

Ah, that probably explains it, we changed how we did things regarding report generation from 2.4 to 5.0, so maybe you ran into that?

Thanks for all the patience!

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.