Version: 7.x-38.0.0
This is an older version of Search Guard. Switch to Latest version
Community

Slack Action

Use Slack actions to send notifications via Slack. You can use Mustache templates to define dynamic content for the Slack message.

Prerequisites

In order to use Slack actions, you need to configure a Slack webhook using the accounts registry of Signals. See the accounts registry documentation for more on that.

Basic Functionality

A basic Slack action looks like this:

 {
	"actions": [
		{
			"type": "slack",
			"name": "my_slack_action",
			"throttle_period": "1h",
			"account": "internal_slack",
			"text": ":warning:\n**Bad destination weather** for {{data.bad_weather_flights.hits.total.value}} flights over last {{data.constants.window}}"
		}
	]
}

The basic configuration attributes are:

name: A name identifying this action. Required.

throttle_period: The throttle period. Optional. Specify the time duration using an amount, followed by its unit. Supported units are m (minutes), h (hours), d (days), w (weeks). For example, 1h means one hour.

checks: Further checks which can gather or transform data and decide whether to execute the actual action. Optional.

account: Identifies the Slack application which shall be used for sending the message. See the accounts registry documentation.

text: Defines the content of the message. Mustache templates can be used to render attributes from the watch runtime data. Optional. See the Slack documentation for details on how to format the message.

blocks: Defines the content of the message in the new Slack Blocks format. Mustache templates can be used to render attributes from the watch runtime data. Optional. See the Slack documentation for details on how to format the message.

attachments: Defines the content of the message in the old Slack Attachments format. Mustache templates can be used to render attributes from the watch runtime data. Optional. See the Slack documentation for details on how to format the message.

Slack Blocks

Slack Blocks allow you to add complex data to the message payload. Slack’s Block Kit Builder provides an intuitive web UI to design Blocks.

 {
    "actions":[
       {
          "type":"slack",
          "name":"my_slack_action",
          "throttle_period":"1h",
          "account":"internal_slack",
          "text":":warning:\n**Bad destination weather** for  flights over last ",
          "blocks":[
             {
                "type":"section",
                "text":{
                   "type":"mrkdwn",
                   "text":"Hey there 👋 A quick warning **Bad destination weather** for  flights over last "
                }
             }
          ]
       }
    ]
 }

Slack Attachments

Slack Attachments allow you to add complex data to the message payload. For more information see Slack Attachments format.

{
  "actions": [
    {
      "type": "slack",
      "name": "my_slack_action",
      "throttle_period": "1h",
      "account": "internal_slack",
      "text": ":warning:\n**Bad destination weather** for  flights over last ",
      "attachments": [
        {
          "blocks": [
            {
              "type": "section",
              "text": {
                "type": "mrkdwn",
                "text": "*Alternative hotel options*"
              }
            },
            {
              "type": "section",
              "text": {
                "type": "mrkdwn",
                "text": "<https://example.com|Bates Motel> :star::star:"
              },
              "accessory": {
                "type": "button",
                "text": {
                  "type": "plain_text",
                  "text": "View",
                  "emoji": true
                },
                "value": "view_alternate_1"
              }
            },
            {
              "type": "section",
              "text": {
                "type": "mrkdwn",
                "text": "<https://example.com|The Great Northern Hotel> :star::star::star::star:"
              },
              "accessory": {
                "type": "button",
                "text": {
                  "type": "plain_text",
                  "text": "View",
                  "emoji": true
                },
                "value": "view_alternate_2"
              }
            }
          ]
        }
      ]
    }
  ]
}


Not what you were looking for? Try the search.