elasticsearchelastic-stackelasticsearch-5elasticsearch-painlesselasticsearch-watcher

how to send email alert to groups based on condition success in kibana watcher action


I am able to categorize various error like this ---

enter image description here

But i want to send email to groups based on error message.

Something like ---

when error ie "key"= "Response status code does not indicate success Service Unavailable" ---send email to group 1 [user1@gmail.com,user2@gmail.com,user3@gmail.com]

when error ie "key"= "Response status code does not indicate success Gateway" ---send email to group 2 [user4@gmail.com,user5@gmail.com,user6@gmail.com]

I have done upto this much ---

  "actions": {
"send_email": {
  "throttle_period_in_millis": 300000,
  "condition": {
    "script": {
      "source": " def status = false; for(int i=0; i<ctx.payload.failure_request.aggregations.categories.buckets.length;i++) {if(ctx.payload.failure_request.aggregations.categories.buckets[i].key.contains('Response status code does not indicate success')) {status = true}} return status ",
      "lang": "painless"
    }
  },
  "email": {
    "profile": "standard",
    "to": [
      "avinash.singh1@spglobal.com"
    ],
    "subject": "{{ctx.metadata.email_subject}}",
    "body": {
      "html": "Error Found: <ul> {{ctx.payload.aggregations.categories.buckets.length}}"
                   }
                 }
              }
            }

Even Email is going to the given email when condition is pass ie when key contains that message. But I want to send email based on message match for specific group at one go.

can any one help me on this if we have something in painless language to write logic like case statement.

Appreciate your help in advance.


Solution

  • These is my advice, I hope that can help you.

    solution one: match with a string

    "actions": {
        "email_group_one" : {
            "condition": {
                "script": {
                    "source": "def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key == 'Response status code does not indicate success Service Unavailable');"
                    "lang": "painless"
                }
            },
            "email" : {
                "to" :  ["user1@gmail.com","user2@gmail.com","user3@gmail.com"],
                "subject" : "YOUR SUBJEC",
                "body" : {
                    "html": "YOUR HTML CODE"
                }
            }
        },
        "email_group_two" : {
            "condition": {
                "script": {
                    "source": "def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key == 'Response status code does not indicate success Gateway');"
                    "lang": "painless"
                }
            },
            "email" : {
                "to" :  ["user4@gmail.com","user5@gmail.com","user5@gmail.com"],
                "subject" : "YOUR SUBJECT",
                "body" : {
                    "html": "YOUR HTML CODE"
                }
            }
        }
    
    }
    

    solution two: match with multiple values like a,b,c and d

    "actions": {
        "email_group_one" : {
            "condition": {
                "script": {
                    "source": "def myArray= ['a', 'b', 'c', 'd'];def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key in myArray);"
                    "lang": "painless"
                }
            },
            "email" : {
                "to" :  ["user1@gmail.com","user2@gmail.com","user3@gmail.com"],
                "subject" : "YOUR SUBJEC",
                "body" : {
                    "html": "YOUR HTML CODE"
                }
            }
        },
        "email_group_two" : {
            "condition": {
                "script": {
                    "source": "def myArray= ['e', 'f', 'g', 'h'];def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key in myArray);"
                    "lang": "painless"
                }
            },
            "email" : {
                "to" :  ["user4@gmail.com","user5@gmail.com","user5@gmail.com"],
                "subject" : "YOUR SUBJECT",
                "body" : {
                    "html": "YOUR HTML CODE"
                }
            }
        }
    
    }
    

    the code has not been tested, you may have syntax errors.