# Watcher webhook to create a OTRS ticket **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [January 24, 2023, 3:24pm UTC](https://discuss.elastic.co/t/watcher-webhook-to-create-a-otrs-ticket/323855 "2023-01-24T15:24:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![M\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_s/32/116340_2.png) [@M\_S](https://discuss.elastic.co/u/M_S)\ **Post date:** [January 24, 2023, 3:24pm UTC](https://discuss.elastic.co/t/watcher-webhook-to-create-a-otrs-ticket/323855/1 "2023-01-24T15:24:11Z")
I can curl and make an OTRS ticket by using the following : curl "[http://myotrs.com/otrs/nph-genericinterface.pl/Webservice/GenericTicketConnectorREST/Ticket?UserLogin=username&Password=password](http://myotrs.com/otrs/nph-genericinterface.pl/Webservice/GenericTicketConnectorREST/Ticket?UserLogin=username&Password=password)" -H "Content-Type: application/json" -d '{ "Ticket" : { "Queue" : "Engineering Team", "Priority" : "P3", "CustomerUser" : "root@localhost", "Title" : "REST Create Test", "State" : "new", "Type" : "Incident" }, "Article" : { "ContentType" : "text/plain; charset=utf8", "Subject" : "Rest Create Test", "Body" : "This is only a test" } }' I want to implement the same using a watcher webhook. I stumbled upon - [Curl to watcher webhook](https://discuss.elastic.co/t/curl-to-watcher-webhook/123958) Can you give some more info about the same? ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [January 24, 2023, 4:39pm UTC](https://discuss.elastic.co/t/watcher-webhook-to-create-a-otrs-ticket/323855/2 "2023-01-24T16:39:52Z")
Yes, you'll want to use the webhook action in Watcher: > **[Watcher webhook action | Elasticsearch Guide \[8.6\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/actions-webhook.html)** ---
**Author:** ![M\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_s/32/116340_2.png) [@M\_S](https://discuss.elastic.co/u/M_S)\ **Post date:** [January 24, 2023, 8:57pm UTC](https://discuss.elastic.co/t/watcher-webhook-to-create-a-otrs-ticket/323855/3 "2023-01-24T20:57:57Z")
Hi, moving onto watchers, now I have been trying this configuration (I want to look for the keyword "error" in my indices and if found, generate an OTRS ticket): ```auto { "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { "body": { "size": 0, "query": { "match_all": "Error" } }, "indices": [ "*" ] } } }, "condition": { "compare": { "ctx.payload.hits.total": { "gte": 1 } } }, "actions" : { "create_otrs" : { "transform": { "script": """{"Ticket":{"Queue":"EngineeringTeam","Priority":"P3","CustomerUser":"root@localhost","Title":"RESTCreateTest","State":"new","Type":"Incident"},"Article":{"ContentType":"text/plain;charset=utf8","Subject":"RestCreateTest","Body":"Thisisonlyatest"}}""" }, "webhook" : { "method" : "POST", "host" : "http://myotrs.com/otrs/nph-genericinterface.pl/Webservice/GenericTicketConnectorREST/Ticket?UserLogin=&Password=", "port": 9200, "body": "{{#toJson}}ctx.payload{{/toJson}}", "auth" : { "basic" : { "username" : "elastic", "password" : "" } } } } } } ``` This gives me compile error. What am I missing here? ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [January 25, 2023, 3:04pm UTC](https://discuss.elastic.co/t/watcher-webhook-to-create-a-otrs-ticket/323855/4 "2023-01-25T15:04:46Z")
Oof...so many problems with this. 1. The `script` section in `transform` is executable code, so you need to `return` the context to the next section (in your case the `webhook` section). 2. Also, notice in that example, the usage of single quotes, not double quotes and square brackets `[]` instead of curly braces `{}` 3. Your search syntax doesn't take time into account. If you want your watch to run every minute, then you should only be looking at the last minute's worth of data. Otherwise, you will always match (or as long as any error exists in your logs for however long you keep them). 4. Do you really want to look over ALL indices ("`*`")? This seems like a bad idea. Specify your index name or index pattern of the indices you really want to query. 5. The username/password in the `auth` is for the system the webhook is authenticating to (so in your case the ticketing system, not to authenticate with elasticsearch) 6. Test your watch using Watcher's `_exectute` endpoint first. Then `PUT` the watch. 7. See example below that will get you close to where you need to be. I just posted to an internet webserver that does nothing, only so I can see the format of what is being sent. ```auto POST _watcher/watch/_execute { "watch": { "trigger": { "schedule": { "interval": "1m" } }, "input": { "search": { "request": { "indices": [ "kibana_sample_data_logs" ], "body": { "query": { "bool": { "must": [ { "query_string": { "query": "error" } }, { "range": { "@timestamp": { "gte": "now-1m" } } } ] } } } } } }, "condition": { "compare": { "ctx.payload.hits.total": { "gte": 1 } } }, "actions" : { "create_otrs" : { "transform": { "script": """return ['Ticket':['Queue':'EngineeringTeam','Priority':'P3','CustomerUser':'root@localhost','Title':'RESTCreateTest','State':'new','Type':'Incident'],'Article':['ContentType':'text/plain;charset=utf8','Subject':'RestCreateTest','Body':'Thisisonlyatest']]""" }, "webhook" : { "method" : "POST", "host" : "echo.zuplo.io", "scheme" : "https", "port": 443, "body": "{{#toJson}}ctx.payload{{/toJson}}", "auth" : { "basic" : { "username" : "myusername", "password" : "mypassword" } } } } } } } ``` ---
**Author:** ![M\_S](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m_s/32/116340_2.png) [@M\_S](https://discuss.elastic.co/u/M_S)\ **Post date:** [January 25, 2023, 3:24pm UTC](https://discuss.elastic.co/t/watcher-webhook-to-create-a-otrs-ticket/323855/5 "2023-01-25T15:24:45Z")
Thanks a lot ..yes there were so many errors. This was first time making something like this. Anyways, can we remove the basic auth part, since for me it goes in the url itself? ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [January 25, 2023, 4:27pm UTC](https://discuss.elastic.co/t/watcher-webhook-to-create-a-otrs-ticket/323855/6 "2023-01-25T16:27:22Z")
> [@M\_S](#): > > Anyways, can we remove the basic auth part, since for me it goes in the url itself? Yes if your curl request works with it being in the URL's query string ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 22, 2023, 4:28pm UTC](https://discuss.elastic.co/t/watcher-webhook-to-create-a-otrs-ticket/323855/7 "2023-02-22T16:28:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.