Watcher not automatically sending any emails

Elastic Stack Elasticsearch
1

I am trying to get the report below automatically sent to me every hour but unfortunately I got several errors. Is there any way to fix them? Did I do the code wrong? Please let me know. Thank you.

Dev Tools Coding for the Watcher is below.

PUT _watcher/watch/daily_report
{
  "trigger" : {
    "schedule": {
      "interval": "1h"
    }
  },
  "actions" : {
    "email_admin" : { 
      "email": {
        "to": "'Angad Panesar <angz.panesar@gmail.comk>'",
        "subject": "Report",
        "attachments" : {
          "daily_report.pdf" : {
            "reporting" : {
              "url": ""https://staging-mc.kb.us-east-1.aws.found.io:9243/api/reporting/generate/csv_searchsource?jobParams=%28browserTimezone%3AEurope%2FLondon%2Ccolumns%3A%21%28%29%2CobjectType%3Asearch%2CsearchSource%3A%28fields%3A%21%28%28field%3A%27%2A%27%2Cinclude_unmapped%3Atrue%29%29%2Cfilter%3A%21%28%28meta%3A%28field%3Adt%2Cindex%3Ab5f332d0-43c7-11ec-b5ab-fbc66f2b8ddf%2Cparams%3A%28%29%29%2Cquery%3A%28range%3A%28dt%3A%28format%3Astrict_date_optional_time%2Cgte%3Anow-2d%2Clte%3Anow%29%29%29%29%2C%28meta%3A%28field%3Adt%2Cindex%3Ab5f332d0-43c7-11ec-b5ab-fbc66f2b8ddf%2Cparams%3A%28%29%29%2Cquery%3A%28range%3A%28dt%3A%28format%3Astrict_date_optional_time%2Cgte%3A%272022-02-15T15%3A05%3A33.019Z%27%2Clte%3A%272022-02-17T15%3A05%3A33.019Z%27%29%29%29%29%29%2Cindex%3Ab5f332d0-43c7-11ec-b5ab-fbc66f2b8ddf%2Cparent%3A%28filter%3A%21%28%29%2Cindex%3Ab5f332d0-43c7-11ec-b5ab-fbc66f2b8ddf%2Cquery%3A%28language%3Akuery%2Cquery%3A%27%27%29%29%2Csort%3A%21%28%28dt%3Adesc%29%29%2CtrackTotalHits%3A%21t%29%2Ctitle%3ALAST_2DAYS%2Cversion%3A%277.17.0%27%29"", 
              "retries":100, 
              "interval":"15s", 
              "auth":{ 
                "basic":{
                  "username":"angad",
                  "password":"xxxx"
                }
              }
            }
          }
        }
      }
    }
  }
}

Output of the PUT method.

{
  "_id" : "daily_report",
  "_version" : 37,
  "_seq_no" : 36,
  "_primary_term" : 1,
  "created" : false
}

The error that I got is displayed below.

"reason": "Watch[daily_report] reporting[daily_report.pdf] Error when polling pdf from host[staging-mc.kb.us-east-1.aws.found.io], port[9243], method[POST], path[/api/reporting/generate/csv_searchsource], status[500], body[{\"statusCode\":500,\"error\":\"Internal Server Error\",\"message\":\"Reporting generation failed: Error: Max attempts (3) reached for job kzr1k5hm000ze229abco2dmb. Failed with: Error: Saved object [index-pattern/e133d0b0-8f14-11ec-98e8-098d0ac4e109] not found\"}]"

2

Wondering why the max attempts are shown as three. Anyway, the exception states that an index pattern could not be find, that the link seems to require? Is everything there as needed?

3

The main problem that I am actually having is that this command keeps sending the same csv report every hour using this link above. The post URL uses the last 24 hours in the discover tab. Every hour, it keeps sending the same data in the csv and it doesn't send newly fresh and updated data recently added. Is there any way that you can help me with this please?

4

Wild guess of looking closely at your dashboard link, there are parameters included that look like a fixed date: 2022-02-15T15:05:33 ... could that be an issue?

5

Yes, even I tried to remove the fixed data of the date strict optional time I still get error exception when running the watcher command. I also noticed that in version 7.17.0 you have to save your search before getting the post URL whereas in previous versions you don't have to save. In the previous versions, you can get the post URL without that fixed date.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.