Web action JSON issue (again)

Elastic Stack Elasticsearch
1

Hi,

I have run into the same problem as several other posters on this topic.

It appears that the webhook action is removing the JSON formatting on the search results;

I am using sense to test and I can see that the search result looks like;

"payload": {
  "_shards": {
    "total": 5,
    "failed": 0,
    "successful": 5
  },
  "hits": {
    "hits": [],
    "total": 0,
    "max_score": 0
  },
  "took": 6,
  "timed_out": false,
  "aggregations": {
    "2": {
      "buckets": []
    }
  }
},

whereas the webhook action looks like;

      "body": "{_shards={total=5, failed=0, successful=5}, hits={hits=[], total=0, max_score=0.0}, took=6, timed_out=false, aggregations={2={buckets=[]}}}"
    },

where I have used

"body": "{{ctx.payload}}"

The is problematic when trying to feed the results into the http logstash input where the default codec is JSON.

Any suggestions ?

2

Hi @paulkeogh

I don't have a good solution for you today, but there is one coming. There are two problems here:

  • ctx.payload is being stringified as a Java hashmap, which clearly isn't valid JSON
  • The body is a string instead of JSON

The first problem will be solved by the new toJson helper which will be available in 2.4.0, and the second can be solved by using Logstash's json filter.

So once 2.4.0 is out, instead of doing

"body": "{{ctx.payload}}"

you could do:

"body": { "my_field": "{{#toJson}}ctx.payload{{/toJson}}" }

and then use the json filter to decode the my_field field