How to pass High CPU Process Name in Kibana Alert Action

[Ranjan-Gupta01]

Hey Team,

As part of preventive monitoring through Kibana, we triggered an alert and used action WebHook. We were able to send Server Name, which triggered the alert, in the Body. We need to pass the process name as well to take appropriate action. With limited variables available, we are not sure which variable/object can help us sending the process name to Web Service.

May you please guide us with the process name in Kibana action?

Thanks, in advance for your help.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[azasypkin]

Hi @Ranjan-Gupta01 ,

The GitHub issues are intended for bug reports, enhancement requests and etc. The question you have fits better for our Discuss forum, would you mind posting questions like this there instead in the future? There much more users like you that can help and probably already solved the problem you have.

But as an exception, since you created it already, let's see if Alerting Services team can give you a hint.

[pmuellr]

What alert are you using? The index threshold alert is very generic, and doesn't provide access to data in the documents that's not used in the threshold calculation. The other more specialized alert types provide additional, specialized data, so we'd need to know which one you're using - guessing it's the metric threshold alert.

There's a similar issue open here - issue #69611 - "Expand the context available within Kibana Alerting" - perhaps we should move the request into that one ...

[Ranjan-Gupta01]

Yes, it is for Metric Threshold alert type. And it is very much similar to #69611. We want to expand the context so that it can return other results while configuring the actions.

[pmuellr]

@Ranjan-Gupta01 do you want to close this one and add your requirement to the referenced issue #69611 ?

[Ranjan-Gupta01]

Thanks, we can close this one and please add the requirement to the other issue #69611 . Thanks again for the help.