Does this syntax looks accurate? I manage to send test message with it to Pagerduty, but alerts are not being sent otherwise…
{ "event_action": "trigger", "payload": {"summary": "Sev 1-4 Alert - {{#ctx.results.0.hits.hits}}
{{_source.url}} - {{_source.incident_name}} - Device IP: {{_source.device_ip}} - Device Host: {{_source.device_host}}
{{/ctx.results.0.hits.hits}}", "source": "ELK Monitor", "severity": "info"} }
translates to this:
{ "event_action": "trigger", "payload": {"summary": "Sev 1-4 Alert - ", "source": "ELK Monitor", "severity": "info"} }