-
Notifications
You must be signed in to change notification settings - Fork 8.5k
Description
Kibana version: 6.4.2
Elasticsearch version: 6.4.2
Description of the problem including expected versus actual behavior:
User reported experience of receiving an action “Error!” when the condition was not true, and the corresponding action was never executed (screenshot attached):
This was reproduced on version 6.3 and the latest version of 6.4.2.
Steps to reproduce:
- Step 1: Create watch (with no index) - everything should be "OK":
PUT _xpack/watcher/watch/log_error_watch
{"trigger":{"schedule":{"interval":"15s"}},"input":{"search":{"request":{"indices":["logs"],"body":{"query":{"match":{"message":"error"}}}}}},"condition":{"compare":{"ctx.payload.hits.total":{"gt":0}}},"actions":{"my_webhook":{"condition":{"compare":{"ctx.payload.hits.total":{"gt":1}}},"webhook":{"method":"PUT","host":"localhost","port":9200,"path":"/alert/_doc/1","body":"{ \"count\" : \"{{ctx.payload.hits.total}}\" }","headers":{"content-type":"application/json"}}},"log_error":{"logging":{"text":"Found {{ctx.payload.hits.total}} errors in the logs"}}}}
- Step 2: Add 1st and 2nd documents to the logs index to satisfy the watch condition - both actions should fire successfully:
POST logs/event/1?refresh=true
{
"timestamp": "2015-05-17T18:12:07.613Z",
"request": "GET index.html",
"status_code": 404,
"message": "Error: File not found"
}
POST logs/event/2?refresh=true
{
"timestamp": "2015-05-17T18:12:07.613Z",
"request": "GET index.html",
"status_code": 404,
"message": "Error: File not found"
}
-
Step 3: Make the webhook fail by closing the alert index that was created by the webhook - should result in "Error!":
POST alert/_close -
Step 4: Delete the 2nd document, making the condition false, so the webhook will be unable to run again (still should show "Error!"):
DELETE logs/event/2 -
Step 5: "Clear" the error by opening the alert index - note the watch will still show "Error!" although the webhook wasn't triggered again:
POST alert/_open
