How to use trigger variables in the message of the raised alert in Kibana ElasticSearch open distro

user_9772211 0
Viewed 881

I am using elastic search open distro.This is my trigger condition :

for (int i = 0; i < ctx.results[0].hits.hits.length; i++) {

    if(2 < ctx.results[0].hits.hits[i]._source.responseTime) {
      score = true;
    } else {
      score = false;
    }

}
return score;

I am trying to send the message with the specific details of my source with the API url and response time, something like below just for all raised alerts(how do we ensure that):

Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.
- **API Url : {{ctx.results.0.hits.hits.0._source.msg}} and response time {{ctx.results.0.hits.hits.0._source.responseTime}}** -- **need details only for raised alerts**
- Trigger: {{ctx.trigger.name}}
- Severity: {{ctx.trigger.severity}}
elasticsearch-opendistro kibana alert eventtrigger monitor
1 Answers
//painless trigger script
def errorCodes = new ArrayList();
for (def item : ctx.results[0].aggregations.mystats.bysats.buckets) {
   if(item.val1 > 5) {
       resMessate.add(item.key);
    }
} 
// at the end..

ctx.results[0].hits["customerror"] = errorCodes;  `




//Now the custom error can be accessed from trigger Action template message format

//i.e

{
    {{#ctx.results.0.hits.customerror}}
        "erroIn": {{.}}     
    {{/ctx.results.0.hits.customerror}}
}
user_106337470
Related