Watcher webhook action with bulk request

Elastic Stack Elasticsearch
1

Hello there,

We would like to use watcher's webhook with a bulk request.
For some reasons, we can't use the same data format indicated in the documentation here -- we get a 400 error.

Do you know if it's actually possible to call a bulk request from a webhook action or is there any alternative solution?

Thanks.

2

Hey,

the index action has support for bulk requests. Would that suit your use-case? If not, please tell us, what is missing.

--Alex

3

Thanks for your reply,
Yes, we indexed many documents at the time in other scenarios but this time
we would like to partially update documents in bulk. I did not think this
was possible with the index action. Is it?

4

Hey,

indeed, that index action does not support partial updates.

--Alex

5

Is there any other way from a watch perspective? Is it possible with a
webhook ? My interrogation is particularly concerning the payload format
expected in bulk requests...

6

Hey,

creating the bulk JSON payload in a script transform might be worth a try, however this also sounds somewhat tedious. You can maybe share what you already tried.

Alternatively have you thought about writing the data to logstash via a webhook and then use the logstash http input to read the data, process it via logstash and write it to ES?

--Alex

7

Thanks Alexander.
I thought of the transform option but yeah it seemed quite tedious.
I ended up doing something similar to the logstash idea. What I did is sending the data to a webserver, process the data and sending back the data to ES. This seemed like our best alternative.
Thanks again
-Ibrahim

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.