(Watcher) send emails separately via a single alert

is there any way the emails are sent separately for each alert notification in the watcher?
as we received several alerts on our team, we preferred that they come separately.

See Running an action for each element in an array | Elasticsearch Guide [7.14] | Elastic

2 Likes

hello @spinscale , thanks so much for the help! I tried using foreach but the alerts are still coming in the same email and not in separate emails.
here is the structure of my watcher:

  "trigger": {
    "schedule": {
      "interval": "3m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "log"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "action": "Prevent"
                  }
                },
                {
                  "match": {
                    "severity": "Critical"
                  }
                },
                {
                  "exists": {
                    "field": "attack"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-2m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 0
      }
    }
  },
  "actions": {
    "send_email": {
      "foreach": "ctx.payload.hits.hits",
      "max_iterations": 500,
      "email": {
        "profile": "standard",
        "to": [
          "mail@mail.com"
        ],
        "subject": "ELK TEST  WATCHER",
        "body": {
          "html": """<table style=" width: 100%; text-align: center;"> <tr >   
        THIS IS A TEST"""
        }
      }
    }
  }
}

can you tell me if there's something wrong?

1 Like

I'm having the same problem as Dovan.
can you help? @spinscale

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.