elasticsearchkibanaelasticsearch-watcher

Create kibana watcher to trigger email with containg kibana json attribute value


We have multiple applications which pushing log into Kibana. In JSON, below parameter will be there :

  1. srcSystem.componentName: "DATA-LAMBDA-FUNCTION"
  2. srcSystem.data.auditJson.job_status: "FAILURE"
  3. srcSystem.data.auditJson.errorMessage: "Bad SQL Grammer.."
  4. srcSystem.data.auditJson.entityName: "Test_Entity1234"

There will be chances available multiple job_status: FAILURE within 5 mins. I want to create Kibana Watcher to trigger email if there are at least single failure every 5 mins. Email should contain like below:

srcSystem.data.auditJson.entityName srcSystem.data.auditJson.errorMessage Test_Entity1234 Authentication Failure Test_4312 Server Down Address_Entity Bad SQL

Can you please help me to create JSON Payload to create Watcher through Kibana Watcher API?


Solution

  • Got the solution by providing the exact JSON.