Watcher: Add the ability to add Slack actions to Slack attachments

[rukas]

It does not appear that the Watcher Slack action supports adding Slack Actions. It would be very helpful to have the ability to add actions such as buttons for alert acknowledgement. I'm currently able to do this outside of Elasticsearch with a POST containing the following body:

{
  "title": "*Something bad happened*",
  "text": "*Something bad happened*",
  "attachments": [
    {
      "text": "Something bad happened",
      "fallback": "Something bad happened",
      "callback_id": "ack_alert",
      "color": "danger",
      "attachment_type": "default",
      "actions": [
        {
          "name": "acknowledge",
          "text": "Acknowledge",
          "type": "button",
          "value": "acknowledge"
        }
      ]
    }
  ]
}

I added the below to my watch configuration in an attempt to get the same functionality out of Watcher:

"slack": {
  "account": "monitoring",
  "message": {
    "from": "Elasticsearch Watcher",
    "to": [
      "#channel"
    ],
    "text": "*Something bad happened*",
    "attachments": [
      {
        "color": "warning",
        "title": "Something bad happened",
        "text": "Something bad happened",
        "callback_id": "ack_alert",
        "actions": [
          {
            "name": "acknowledge",
            "text": "Acknowledge",
            "type": "button",
            "value": "acknowledge"
          }
        ]
      }
    ]
  }
}

But the error I get is Watcher: [parse_exception] could not parse message attachment field. unexpected field [callback_id] which makes me assume that the Slack action in Watcher does not support adding actions to attachments.

Elasticsearch version: 6.2.4

[elasticmachine]

Pinging @elastic/es-core-infra

[spinscale]

Is it possible that you are confusing two actions here from the slack API? The one using the callback id (as mentioned here) is a different feature, than using an attachment action, which should be supported. However this one does not need the callback_id parameter which you are using in your watch and which is the cause of the exception. At least I have not found that one in the official slack documentation for message attachments - or looked at the wrong spot.

[rukas]

That is correct that an action is different than the attachment which is currently supported in Watcher. This page has the documentation on creating Slack actions which allow for interactive messages and includes documentation on the required callback_id field.

[spinscale]

thanks for that link, didnt spot it. Indeed this is currently not supported.

[vpavlushkov]

Three months later spotted the same issue, see this thread. It is still present in 6.3.2 and 6.4.0 releases.

[rukas]

@spinscale @hub-cap Any word on whether or not this will be supported in a future release?

[L-F-Escobar]

Really sucks this isnt supported. Slack has new docs and it seems that _watcher is operating on the old docs plus it has limited functionality

For example something like this will not work despite the fact that the slack api supports this

"actions": {
  "notify-slack" : {
  "slack" : {
    "message" : {
      "from" : "The night is dark and full of errors.",
      "to" : [ "#log_side_test" ],
      "text" : "Night gathers and now my watch begins.",
      "attachments" : [{
        "pretext": "Watch Id : {{ctx.watch_id}}",
        "title" : "Errors Found! Kibana Dashboard Link.",
        "image_url" : "INSERT_PNG_FILE",
        "text" : "*Text Here*",
        "title_link": "https://www.google.com",
        "color" : "danger",
        "actions": [{
                "name": "action",
                "type": "button",
                "text": "Complete this task",
                "style": "",
                "value": "complete"
        }],
        "mrkdwn_in": ["python"]
      }]
    }
  }
}
}

[microsoftly]

+1 here. Adding buttons works when simulating the watch and I can successfully save it, but then I can never edit it again due to the parsing exception

[jderose9]

+1 need this.. footers too.

[jonbk]

+1 for every properties that Slack provide on attachements

      {
          "fallback": "Plain-text summary of the attachment.",
          "color": "#2eb886",
          "pretext": "Optional text that appears above the attachment block",
          "author_name": "Bobby Tables",
          "author_link": "http://flickr.com/bobby/",
          "author_icon": "http://flickr.com/icons/bobby.jpg",
          "title": "Slack API Documentation",
          "title_link": "https://api.slack.com/",
          "text": "Optional text that appears within the attachment",
          "fields": [
              {
                  "title": "Priority",
                  "value": "High",
                  "short": false
              }
          ],
          "image_url": "http://my-website.com/path/to/image.jpg",
          "thumb_url": "http://example.com/path/to/thumb.png",
          "footer": "Slack API",
          "footer_icon": "https://platform.slack-edge.com/img/default_application_icon.png",
          "ts": 123456789
      }
  ]```

[LanceSandino]

same I need this :|

[rozling]

This feature request really needs more attention - Slack alerts have limited use in a noisy production environment without the ability to at least ack the Watch from the alert itself; this is something that has prevented us from fully embracing Watcher as an alerting tool.

On the flip side it would open up lots of cool functionality that I think would encourage people to get creative with Watches.

It's probably worth mentioning that Elastic have updated their roadmap with regard to alerting as detailed in this blog post from September 2019, and I understand a lot of work is being done on that at the moment.

However as mentioned in that post:

Alerting complements and works alongside Watcher, it does not replace it.

So unless someone from Elastic can correct me, it seems we will still be relying on how Watcher exposes the Slack API for some time to come.

This issue is getting old now, and the solution mentioned by @spinscale in #34546 (under 'Stop strict parsing of JSON structures sent to 3rd parties') seems to me like a good idea for the time being?

[shahargl]

+1
any news about supporting new slack API features?

[jannisrelakis]

+1
footer icon does not seem to be supported. I am using 7.8.

[sumew]

+1