How do i include message fields in the Alert Action Message

Hello,
I use OpenSearch for logs from docker containers.
I created an alert to Slack and would like to include logs message fields inside the Alert Action Message,
For example here is my lo JSON that i would like to take some fields from it(like container_name) and include them into Action Message to be send to slack.
Screen Shot 2022-01-02 at 16.13.25

Currently my Action Message is the default one.
Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.

  • Message: {{ctx.monitor.name}}
  • Trigger: {{ctx.trigger.name}}
  • Severity: {{ctx.trigger.severity}}
  • Alert time: {{ctx.periodStart}}

I tried to access fields by doing something like that but without success:

Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.> Alert time {{ctx.periodStart}}

Errors Count: {{ctx.results.0.hits.total.value}}
{{#ctx.results.0.hits.hits}}
{{_source.container.name}} - {{_source.host}} - {{_source.m.alert.severity}}
{{_source.m.alert.name}}
{{/ctx.results.0.hits.hits}}

How can i do that?
Thank you.

1 Like

I figured it out, thanks.

Glad to hear you figured it out @AndreyB - if you have the time to post your solution, I’m sure the rest of the community would find it useful

1 Like

So here is the solution:

  1. Discover the data you want to add alert to it in index.
  2. Save the query.
  3. Create a monitor based on query and change the default format to epoch_millis.
{
    "size": 500,
    "query": {
        "bool": {
            "filter": [
                {
                    "match_all": {
                        "boost": 1
                    }
                },
                {
                    "exists": {
                        "field": "m.alert.severity",
                        "boost": 1
                    }
                },
                {
                    "exists": {
                        "field": "m.alert.name",
                        "boost": 1
                    }
                },
                {
                    "range": {
                        "@timestamp": {
                            "from": "{{period_end}}||-2m",
                            "to": "{{period_end}}",
                            "include_lower": true,
                            "include_upper": true,
                            "format": "epoch_millis",
                            "boost": 1
                        }
                    }
                }
            ],
            "adjust_pure_negative": true,
            "boost": 1
        }
    },
    "version": true,
    "_source": {
        "includes": [],
        "excludes": []
    },
    "stored_fields": "*",
    "docvalue_fields": [
        {
            "field": "@timestamp",
            "format": "date_time"
        },
        {
            "field": "created",
            "format": "date_time"
        },
        {
            "field": "m.params.cartProducts.createdTime",
            "format": "date_time"
        },
        {
            "field": "m.time",
            "format": "date_time"
        }
    ],
    "script_fields": {},
    "sort": [
        {
            "@timestamp": {
                "order": "desc",
                "unmapped_type": "boolean"
            }
        }
    ],
    "aggregations": {
        "2": {
            "date_histogram": {
                "field": "@timestamp",
                "time_zone": "Asia/Jerusalem",
                "fixed_interval": "1s",
                "offset": 0,
                "order": {
                    "_key": "asc"
                },
                "keyed": false,
                "min_doc_count": 1
            }
        }
    },
    "highlight": {
        "pre_tags": [
            "@opensearch-dashboards-highlighted-field@"
        ],
        "post_tags": [
            "@/opensearch-dashboards-highlighted-field@"
        ],
        "fragment_size": 2147483647,
        "fields": {
            "*": {}
        }
    }
}
1 Like

Thank you @AndreyB - appreciate the write up!

1 Like

Hi @AndreyB,

thanks a lot.
I’ve got same challenge.
Is there a way to send PM to you?
Thanks

Hi @zubrik ,
You can write it here, we will try to figure it out.
Or jut send me a private message.

1 Like