query output to email action

Question

I am trying to use watcher API to send alerts.

https://www.elastic.co/guide/en/elasticsearch/reference/5.5/watcher-api-put-watch.html

I am able to set an example as explained above. When I check my mail, I can see the "subject" line correctly. But I need the output of a query as body of the email. How is this achieved using x-pack?

Answer 1

In the example at the documentation, it only specifies the subject.

You can see an example with body in this page: https://www.elastic.co/guide/en/x-pack/5.5/actions-email.html

It specifies the body, and adds the response in JSON format to the attachment of the email.

...
"actions" : {
    "email_administrator" : {
      "email" : {
        "to" : "sys.admino@host.domain",
        "subject" : "Encountered {{ctx.payload.hits.total}} errors",
        "body" : "Too many error in the system, see attached data",
        "attachments" : {
          "attached_data" : {
            "data" : {
              "format" : "json"
            }
          }
        },
        "priority" : "high"
      }
    }
]
...