Webhook not sending json format

Elastic Stack Elasticsearch
1

Hi,

I want to send watcher data in json format. Here is my json string of watcher query

{
          "trigger" : { "schedule" : { "interval" : "10s" } }, 
          "input" : { 
            "search" : {
              "request" : {
                "indices" : [ "k8s*" ],
                "body" : {
                    "query": {
                       "match":{"reason" : "FailedSync"}
                    }
                }
              }
            }
          },
          "condition" : {
            "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
          },
        "actions" : {
          "my_webhook" : {
            "webhook" : {
              "method" : "PUT",
              "host" : "tcmonitor",
              "port" : 5080,
              "headers" : {
                  "Content-Type": "application/json"
              },
              "path": "/rules/results", 
              "body" : "{\"results\":\"{{ctx.payload.hits.hits.1}}\"}"
            }
          }
        }
    }

I get the webhook request to python flask framework at /rules/results. Python flask thrwoing error saying the string not in json format.

I used tcpdump to capture packet in ASCII format. I see the packet does not have quote around it. Here is the packet capture. As you can see below there is no quote around _type, Pod...

{"results":{ {_type=Pod, _source={message=Error syncing pod, skipp
ing: [failed to "StartContainer" for "openrg" with ImagePullBackOff: "Back-off p
ulling image \"engci-docker.cisco.com:5933/vcpe-openrg:5\""
, failed to "StartContainer" for "sidecar" with ImagePullBackOff: "Back-off pull
ing image \"engci-docker.cisco.com:5933/tccp-hyperagent\""
], reason=FailedSync, severity=Warning, impacted_object={id=d3c154ca-3f63-11e6-9
7db-fa163eeb6065, name=ed405aa43dd5441c9787b97-cpe-zzpot, type=Pod}}, _id=AVWrzU
g_hu_4kJYUMyFr, _index=k8s, _score=2.3613377} }}?

{
    "message": "Failed to decode JSON object: Expecting property name enclosed i
n double quotes: line 1 column 14 (char 13)"
}

But when I look in watch records, I see quote inside elastic search watch records

{
                  "_type" : "Pod",
                  "_source" : {
                    "message" : "Error syncing pod, skipping: [failed to \"StartContainer\" for \"openrg\" with ImagePullBackOff: \"Back-off pulling image \\\"engci-docker.cisco.com:5933/vcpe-openrg:5\\\"\"\n, failed to \"StartContainer\" for \"sidecar\" with ImagePullBackOff: \"Back-off pulling image \\\"engci-docker.cisco.com:5933/tccp-hyperagent\\\"\"\n]",
                    "reason" : "FailedSync",
                    "severity" : "Warning",
                    "impacted_object" : {
                      "id" : "d3c154ca-3f63-11e6-97db-fa163eeb6065",
                      "name" : "ed405aa43dd5441c9787b97-cpe-zzpot",
                      "type" : "Pod"
                    }

How to get data in json format in webhook?

Thanks
Bharat

2

Can anybody share your thoughts/exeperience? Can I open bug for this?

Thanks
Bharat

3

Hey,

You can use the Execute Watch API to check, what the request body looks like. In the actions part at the end of the output, you will find the body, which should show what is sent to the server.

--Alex