Hello, I am using the latest version of OpenSearch and OpenSearch Dashboards. My goal is to check if each document indexed in a specified index pattern matches a specific field, and if it does, send an alert to a custom webhook.
I configured the monitor as follows:
My query is:
{
“description”: “”,
“queries”: [
{
“id”: “4a4d4a18-8776-4564-a43f-dcc699d29c04”,
“name”: “Detect_alert”,
“fields”: ,
“query”: “EventType:"alert"”,
“tags”: ,
“query_field_names”:
}
]
}
My trigger condition is:
query[name=Detect_alert]
And as an action I sent an alert to a custom webhook with the message:
{
“test” : “test”
}.
All good so far. I am receiving the POST requests correctly on my custom webhook for every document that meets the conditions. However, I would like to include some data from each document, such as the fields [“Message”, “DeviceId”, etc.], in the message sent to the webhook. Observing the Trigger Info results, I noticed that the results only contain the document’s id along with its index.
“results”: [
{
“4a4d4a18-8776-4564-a43f-dcc699d29c04”: [
“Bte72pAB5TTZtaAgM7Vj|topic-wifi”,
“Bde72pAB5TTZtaAgM7Vh|topic-wifi”,
“BNe72pAB5TTZtaAgM7Vf|topic-wifi”,
“A9e72pAB5TTZtaAgM7Ve|topic-wifi”,
“Ade62pAB5TTZtaAgvbWI|topic-wifi”,
“ANe62pAB5TTZtaAgvbWI|topic-wifi”,
“_9e62pAB5TTZtaAgvbSI|topic-wifi”,
“_te62pAB5TTZtaAgvbSI|topic-wifi”,
“_de62pAB5TTZtaAgvbSD|topic-wifi”,
“-9e62pAB5TTZtaAgRrTf|topic-wifi”,
“-te62pAB5TTZtaAgRrTe|topic-wifi”,
“-Ne62pAB5TTZtaAgRrTc|topic-wifi”,
“-de62pAB5TTZtaAgRrTc|topic-wifi”,…]
}
]
Is there a way to include the document information and use their fields to send additional data to my webhook?
For example, send a message like:
{{#ctx.results}}
{
"Alert on ":{{$query_id.$document_that_trieggered_the_alert.DeviceId}}
“Message”:{{$query_id.$document_that_trieggered_the_alert.Message}}
}
{{/ctx.results}}
I apologize if this issue has already been addressed. If so, could you please direct me to the previous solutions?
Thank you!