Real examples needed

[jizhoubo]

Hi, Would you mind providing a worked example? I am able to send message to slack webhook, and receive slack notifications, however, I cannot properly use slack's attachment, which I believe is due to encoding / escaping issue.

It would be a great help if you can provide an example, containing usages of "text" and "attachment" properties

[seanmuth]

I agree, some examples would be great. I'm stuck at the same place jizhoubo is trying to use the "attachment" properties.

[orrery]

ditto, how is attachment meant to be used?

[seanmuth]

Hey there. I ended up just using the http output and built my own json payload. Way easier and more effective On Jun 8, 2016 7:52 PM, "orrery" [email protected] wrote:

ditto, how is attachment meant to be used?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/cyli/logstash-output-slack/issues/24#issuecomment-224781433, or mute the thread https://github.com/notifications/unsubscribe/AMQbT1Bm7gPC19PeLVFFA8K9Q3l8NIKqks5qJ3HBgaJpZM4HoNWJ .

[orrery]

That is a great suggestion @seanmuth ! thx

[cyli]

Hey, sorry for he complete lack of response. I have been really busy lately, and also don't really know ruby. :). Will try to get to this after my current deadline. Thanks @seanmuth for providing a better solution!

[mhunsber]

@seanmuth how did you format your output plugin to be payload={}? I've been trying to get this to work and nothing seems to satisfy slack.

[seanmuth]

@mhunsber I no longer work at the company I did this work for, and honestly can't remember what exactly I did! I'm trying to get a coworker there to send me the redacted logstash.conf file so I can share my solution will you guys.

[seanmuth]

@mhunsber Alrighty, I got a coworker to send me the .conf file we used. Below are the relevant pieces:

first I build the json payload within a mutate {} inside of the filter {} block:

add_field => { "[@metadata][docjson]" => '{"icon_emoji":":elk-serv:","attachments":[{"color":"#FF0000","fallback":"%{[@metadata][errormessage_json]}","fields":[{"short":false,"title":"","value":"``%{[@metadata][errormessage_json]}``"}],"mrkdwn_in":["fields"],"title":"An error has occurred on %{host} at %{hostcon_timestamp}","title_link":"http://elksrv/app/kibana#/doc/filebeat-hctraceerrorlog-*/%{[@metadata][beat]}-hctraceerrorlog-%{+YYYY.MM.dd}/hcperfstatslog?id=%{[@metadata][generated_id]}"}]}'}

then the http {} block inside the output {} block is simply:

http { http_method => post format => message content_type => "application/json; charset=UTF-8" url => "https://hooks.slack.com/services/XXXXXXX/XXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXX" message => "%{[@metadata][docjson]}" }

[mhunsber]

@seanmuth thank you so much for replying so quickly today! I have been beating my head against a wall all day and this solved it.

[seanmuth]

@mhunsber good to hear! It's the end of my sprint and I haven't had much to do today anyways!

[chhetripradeep]

@seanmuth I tried your configuration, it works great, but there are some messages which are not able to go to slack and returning 400 (i.e Bad Request). Do you know any workaround ?

[madboxkr]

Sample is here

slack {
    url            => "https://hooks.slack.com/~~~~~"
    channel        => "NameName"
    username       => "NameName"
    attachments    => [{
                               color => "good"
                               text => "Event TextText"
                               fields => [
                                 { title => "User"
                                   value => "UserName"
                                   short => "true"
                                 },
                                 { title => "From"
                                   value => "FromFrom"
                                   short => "true"
                                 }
                               ]
                            }]
 }