Sergii Bondarenko
Tags: Alerting
In this part of our series we will create a new webhook action and then use it to send notifications to it.

Webhook actions

For the webhook action, find the Add button in the Action panel header, click it and select Webhook in the menu.
1 elasticsearch alerting add webhook action
Now you see the webhook action form with the empty Url field.
2 elasticsearch alerting webhook add url
The Url field is a required field. To get a webhook URL for this test, go to There you find the URL created for you under Here’s your unique URL... text. Copy it.
3 elasticsearch alerting test webhook url
Now, go back to Signals app and paste the URL in the Url field of the Webhook action.
4 elasticsearch alerting add webhook url
Scroll down to Body and put the following text in the text area:
Avg ticket price: {{data.mysearch.aggregations.metricAgg.value}}
Notice, you can use Mustache to get access to the watch response object and create nice templates. The keys data.mysearch are constant keys that are used by the wizard watch to store Elasticsearch response body and aggregation results. The aggregation values are available behind metricAgg and dateAgg constant keys. In the Preview text area, you can see the response created by the Mustache template. This message will be sent to the webhook server.
5 elasticsearch alerting moustache
Note that in the near feature, we will also provide a possibility to see the Elasticseatrch response directly from the action form. Now you can see the response in other watch modes: Json and Blocks. Also, the response is provided in the browser console with the verbose mode enabled.
6 elasticsearch alerting response verbose
Click the Create button to store the watch.
7 elasticsearch alerting create watch


You will be redirected to the Watches page. Now, the table contains the watch. The Last Status of the watch should be Triggered.
8 elasticsearch alerting watch triggered
To inspect the watch action, click the inspect button.
9 elasticsearch alerting inspect watch history
You will be redirected to the Execution History page where you can see the watch responses. Click on an Id and see the details.
10 elasticsearch alerting watch history
Finally, go back to and see your POST has arrived.
11 elasticsearch alerting webhook delivered

Activating the JSON mode

Let’s see more about the wizard watch query, condition, and Elasticsearch response. Go to Watches table and click on the watch Id.
1 elasticsearch alerting watch id
While on the Define Watch page, scroll down to the Definition panel and change Type to Json.
2 elasticsearch alerting json mode
Now you see the watch query in the Checks text area. Click on the Execute button and you see the Elasticsearch response. You can edit the watch query and condition and execute the watch to see new results.
3 elasticsearch alerting json details

Where to go next

Image: Shutterstock / Ateverna
Published: 2020-02-19
linkedIn icon
y icon
Questions? Drop us a line!
your message
This form collects your name and email. Please take a look in our privacy policy for a better understanding on how we protect and manage your submitted data.
Other posts you may like
follow us
twitter iconfacebook iconlinkedIn iconyoutube icon
Search Guard Newsletter
For the latest product developments, new versions and cybersecurity news, sign up to our newsletter.