New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« IBM Resilient action Jira action »
Elastic Docs ›Kibana Guide [7.11] ›Alerting and Actions ›Action and connector types

Index action

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Index action

edit

The index action type will index a document into Elasticsearch. See also the create index API.

Connector configuration

edit

Index connectors have the following configuration properties:

Name
The name of the connector. The name is used to identify a connector in the management UI connector listing, or in the connector list when configuring an action.
Index
The Elasticsearch index to be written to.
Refresh
Setting for the refresh policy for the write request.
Execution time field
This field will be automatically set to the time the alert condition was detected.

Preconfigured action type

edit
 my-index:
   name: action-type-index
   actionTypeId: .index
   config:
     index: .kibana
     refresh: true
     executionTimeField: somedate

config defines the action type specific to the configuration and contains the following properties:

index

A string that corresponds to Index.

refresh

A boolean that corresponds to Refresh.

executionTimeField

A string that corresponds to Execution time field.

Action configuration

edit

Index actions have the following properties:

Document
The document to index in JSON format.

Example of the index document for Index Threshold alert:

{
    "alert_id": "{{alertId}}",
    "alert_name": "{{alertName}}",
    "alert_instance_id": "{{alertInstanceId}}",
    "context_message": "{{context.message}}"
}

Example of create test index using the API.

PUT test
{
    "settings" : {
        "number_of_shards" : 1
    },
    "mappings" : {
        "properties" : {
            "alert_id" : { "type" : "text" },
            "alert_name" : { "type" : "text" },
            "alert_instance_id" : { "type" : "text" },
            "context_message": { "type" : "text" }
        }
    }
}
« IBM Resilient action Jira action »
Was this helpful?
Feedback