how to send email alert to groups based on condition success in kibana watcher action

Question

I am able to categorize various error like this ---

But i want to send email to groups based on error message.

Something like ---

when error ie "key"= "Response status code does not indicate success Service Unavailable" ---send email to group 1 [[email protected],[email protected],[email protected]]

when error ie "key"= "Response status code does not indicate success Gateway" ---send email to group 2 [[email protected],[email protected],[email protected]]

I have done upto this much ---

  "actions": {
"send_email": {
  "throttle_period_in_millis": 300000,
  "condition": {
    "script": {
      "source": " def status = false; for(int i=0; i<ctx.payload.failure_request.aggregations.categories.buckets.length;i++) {if(ctx.payload.failure_request.aggregations.categories.buckets[i].key.contains('Response status code does not indicate success')) {status = true}} return status ",
      "lang": "painless"
    }
  },
  "email": {
    "profile": "standard",
    "to": [
      "[email protected]"
    ],
    "subject": "{{ctx.metadata.email_subject}}",
    "body": {
      "html": "Error Found: <ul> {{ctx.payload.aggregations.categories.buckets.length}}"
                   }
                 }
              }
            }

Even Email is going to the given email when condition is pass ie when key contains that message. But I want to send email based on message match for specific group at one go.

can any one help me on this if we have something in painless language to write logic like case statement.

Appreciate your help in advance.

Answer 1

These is my advice, I hope that can help you.

solution one: match with a string

"actions": {
    "email_group_one" : {
        "condition": {
            "script": {
                "source": "def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key == 'Response status code does not indicate success Service Unavailable');"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["[email protected]","[email protected]","[email protected]"],
            "subject" : "YOUR SUBJEC",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    },
    "email_group_two" : {
        "condition": {
            "script": {
                "source": "def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key == 'Response status code does not indicate success Gateway');"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["[email protected]","[email protected]","[email protected]"],
            "subject" : "YOUR SUBJECT",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    }

}

solution two: match with multiple values like a,b,c and d

"actions": {
    "email_group_one" : {
        "condition": {
            "script": {
                "source": "def myArray= ['a', 'b', 'c', 'd'];def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key in myArray);"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["[email protected]","[email protected]","[email protected]"],
            "subject" : "YOUR SUBJEC",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    },
    "email_group_two" : {
        "condition": {
            "script": {
                "source": "def myArray= ['e', 'f', 'g', 'h'];def status = ctx.payload.failure_request.aggregations.categories.buckets; if (status.size() == 0) return false; return hosts.stream().anyMatch(p -> p.key in myArray);"
                "lang": "painless"
            }
        },
        "email" : {
            "to" :  ["[email protected]","[email protected]","[email protected]"],
            "subject" : "YOUR SUBJECT",
            "body" : {
                "html": "YOUR HTML CODE"
            }
        }
    }

}

the code has not been tested, you may have syntax errors.