Skip to content

Error in Watcher UI with watches that include action level conditions #25134

@maggiejg

Description

@maggiejg

Kibana version: 6.4.2

Elasticsearch version: 6.4.2

Description of the problem including expected versus actual behavior:
User reported experience of receiving an action “Error!” when the condition was not true, and the corresponding action was never executed (screenshot attached):

This was reproduced on version 6.3 and the latest version of 6.4.2.

Steps to reproduce:

  • Step 1: Create watch (with no index) - everything should be "OK":
PUT _xpack/watcher/watch/log_error_watch
{"trigger":{"schedule":{"interval":"15s"}},"input":{"search":{"request":{"indices":["logs"],"body":{"query":{"match":{"message":"error"}}}}}},"condition":{"compare":{"ctx.payload.hits.total":{"gt":0}}},"actions":{"my_webhook":{"condition":{"compare":{"ctx.payload.hits.total":{"gt":1}}},"webhook":{"method":"PUT","host":"localhost","port":9200,"path":"/alert/_doc/1","body":"{ \"count\" : \"{{ctx.payload.hits.total}}\" }","headers":{"content-type":"application/json"}}},"log_error":{"logging":{"text":"Found {{ctx.payload.hits.total}} errors in the logs"}}}}
  • Step 2: Add 1st and 2nd documents to the logs index to satisfy the watch condition - both actions should fire successfully:
POST logs/event/1?refresh=true
{
  "timestamp": "2015-05-17T18:12:07.613Z",
  "request": "GET index.html",
  "status_code": 404,
  "message": "Error: File not found"
}
POST logs/event/2?refresh=true
{
  "timestamp": "2015-05-17T18:12:07.613Z",
  "request": "GET index.html",
  "status_code": 404,
  "message": "Error: File not found"
}
  • Step 3: Make the webhook fail by closing the alert index that was created by the webhook - should result in "Error!":
    POST alert/_close

  • Step 4: Delete the 2nd document, making the condition false, so the webhook will be unable to run again (still should show "Error!"):
    DELETE logs/event/2

  • Step 5: "Clear" the error by opening the alert index - note the watch will still show "Error!" although the webhook wasn't triggered again:
    POST alert/_open

Screenshots
watcher_error

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature:WatcherbugFixes for quality problems that affect the customer experience

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions