# Watcher:failed to send sample slack message to user
**URL:** https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [October 16, 2018, 10:01am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624 "2018-10-16T10:01:41Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [October 16, 2018, 10:01am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624/1 "2018-10-16T10:01:41Z")
HI,
I want to create new threshold alert and alert should send via slack. I have configured my slack webhook URL on elasticsearch.yml. when i try to send sample i'm below error,
watcher:failed to send sample slack message to user
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 16, 2018, 11:16am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624/2 "2018-10-16T11:16:58Z")
can you share the full output of the [Execute Watch API](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/watcher-api-execute-watch.html) of that particular watch please? Thank you!
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [October 16, 2018, 11:30am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624/3 "2018-10-16T11:30:10Z")
Thanks for your reply
when i run the below command i got this response,
curl -XPOST "[http://localhost:9200/\_xpack/watcher/watch/55dffc80-aae3-41e0-a555-08cec8aab1a5/\_execute](http://localhost:9200/_xpack/watcher/watch/55dffc80-aae3-41e0-a555-08cec8aab1a5/_execute)"
`{"_id":"55dffc80-aae3-41e0-a555-08cec8aab1a5_7f50223d-e204-4eb2-8210-beaab5f6e210-2018-10-16T11:29:02.139Z","watch_record":{"watch_id":"55dffc80-aae3-41e0-a555-08cec8aab1a5","node":"XIqSqBYTQQWQC1lBbTWepw","state":"executed","status":{"state":{"active":true,"timestamp":"2018-10-16T11:28:05.092Z"},"last_checked":"2018-10-16T11:29:02.139Z","last_met_condition":"2018-10-16T11:29:02.139Z","actions":{"slack_1":{"ack":{"timestamp":"2018-10-16T11:28:05.092Z","state":"awaits_successful_execution"},"last_execution":{"timestamp":"2018-10-16T11:29:02.139Z","successful":false,"reason":""}}},"execution_state":"executed","version":1},"trigger_event":{"type":"manual","triggered_time":"2018-10-16T11:29:02.139Z","manual":{"schedule":{"scheduled_time":"2018-10-16T11:29:02.139Z"}}},"input":{"search":{"request":{"search_type":"query_then_fetch","indices":["lomo-nemo-report-*"],"types":[],"body":{"size":0,"query":{"bool":{"filter":{"range":{"@timestamp":{"gte":"{{ctx.trigger.scheduled_time}}||-5m","lte":"{{ctx.trigger.scheduled_time}}","format":"strict_date_optional_time||epoch_millis"}}}}}}}}},"condition":{"script":{"source":"if (ctx.payload.hits.total > params.threshold) { return true; } return false;","lang":"painless","params":{"threshold":4}}},"metadata":{"name":"testing","watcherui":{"trigger_interval_unit":"m","agg_type":"count","time_field":"@timestamp","trigger_interval_size":1,"term_size":5,"time_window_unit":"m","threshold_comparator":">","term_field":null,"index":["lomo-nemo-report-*"],"time_window_size":5,"threshold":4,"agg_field":null},"xpack":{"type":"threshold"}},"result":{"execution_time":"2018-10-16T11:29:02.139Z","execution_duration":27,"input":{"type":"search","status":"success","payload":{"_shards":{"total":30,"failed":0,"successful":30,"skipped":0},"hits":{"hits":[],"total":21,"max_score":0.0},"took":4,"timed_out":false},"search":{"request":{"search_type":"query_then_fetch","indices":["lomo-nemo-report-*"],"types":[],"body":{"size":0,"query":{"bool":{"filter":{"range":{"@timestamp":{"gte":"2018-10-16T11:29:02.139Z||-5m","lte":"2018-10-16T11:29:02.139Z","format":"strict_date_optional_time||epoch_millis"}}}}}}}}},"condition":{"type":"script","status":"success","met":true},"transform":{"type":"script","status":"success","payload":{"result":21}},"actions":[{"id":"slack_1","type":"slack","status":"failure","slack":{"account":"monitoring","sent_messages":[{"status":"failure","error":{"root_cause":[{"type":"unknown_host_exception","reason":"hooks.slack.com: Name or service not known"}],"type":"unknown_host_exception","reason":"hooks.slack.com: Name or service not known"},"to":"Ganesh Elangovan","message":{"from":"Watcher","text":"Watch [testing] has exceeded the threshold"}}]}}]},"messages":[]}}`
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 16, 2018, 2:31pm UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624/4 "2018-10-16T14:31:45Z")
Check out this snippet:
> [@Ganesh2303](#):
>
> "type":"unknown\_host\_exception","reason":"[hooks.slack.com](http://hooks.slack.com): Name or service not known"}
This means, that somehow the system the watch is being executed on, cannot resolve `hooks.slack.com` via its DNS configuration. Could you verify that?
--Alex
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [October 16, 2018, 3:15pm UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624/5 "2018-10-16T15:15:51Z")
> [@spinscale](#):
>
> cannot resolve `hooks.slack.com` via its DNS configuration. Could you verify that?
how could i verify it @spinscale
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 16, 2018, 9:24pm UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624/6 "2018-10-16T21:24:12Z")
logging into the system and using `nslookup` or `host` and try to resolve that slack hostname.
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [October 17, 2018, 5:04am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624/7 "2018-10-17T05:04:50Z")
Thank you for your response @spinscale
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 14, 2018, 5:04am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-sample-slack-message-to-user/152624/8 "2018-11-14T05:04:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.