Integrate with X-Pack (Elasticsearch Watcher)

This article highlights a new alerting feature that's natively available in Jira Service Management which is gradually rolling out to some Jira Service Management Cloud customers. It may not yet be visible or available on your site.

What does the integration offer?

Use the X-Pack Alerting Integration to forward X-Pack Alerting alerts to Jira Service Management. Jira Service Management acts as a dispatcher for these alerts and determines the right people to notify based on on-call schedules– notifies via email, text messages (SMS), phone calls, and iPhone & Android push notifications, and escalates alerts until they are acknowledged or closed.

How does the integration work?

When an alert is fired by X-Pack Alerting, an alert is created in Jira Service Management automatically through the integration. When the alert is acknowledged in Jira Service Management, the alert is acknowledged in X-Pack Alerting.

Set up the integration

X-Pack Alerting is a bidirectional integration. Setting it up involves the following steps:

Add an X-Pack Alerting integration in Jira Service Management
Configure the integration in X-Pack Alerting

Add an X-Pack Alerting integration

Bidirectional integrations aren’t supported in Free and Standard plans. All the other integrations are supported at a team level in Free and Standard; however, for their outgoing part to work, you need to upgrade to a higher plan. To add any integration at a site level through Settings (gear icon) > Products (under JIRA SETTINGS) > OPERATIONS, you need to be either on Premium or Enterprise.

Adding an integration from your team’s operations page makes your team the owner of the integration. This means Jira Service Management only assigns the alerts received through this integration to your team.

To add an X-Pack Alerting integration in Jira Service Management, complete the following steps:

Go to your team’s operations page.
On the left navigation panel, select Integrations and then Add integration.
Run a search and select “X-Pack Alerting”.
On the next screen, enter a name for the integration.
Optional: Select a team in Assignee team if you want a specific team to receive alerts from the integration.
Select Continue.
The integration is saved at this point.
Expand the Steps to configure the integration section and copy the API key.
You will use this key while configuring the integration in X-Pack Alerting later.
Copy the code provided in the "Configure the integration in X-Pack Alerting" section of this article.
You will use this code while configuring the integration in X-Pack Alerting later.
Select Turn on integration.
The rules you create for the integration will work only if you turn on the integration.

Configure the integration in X-Pack Alerting

Paste the code you copied while adding the integration in Jira Service Management in Elasticsearch.
Configure alert settings in X-Pack Alerting.
For more information about X-Pack Alerting, refer to X-Pack Alerting Documentation.
Paste the API key previously copied from Jira Service Management into [YOUR API KEY].

Other configuration of your X-Pack Alerting

(in JSON format)

PUT _watcher/watch/[WATCH ID]
{
    [OTHER CONFIGURATIONS OF YOUR X-PACK ALERTING ALERT]
    .
    .
    .
    .
    .
    "actions" : {
        "jsm": {
            "webhook": {
                "scheme": "https",
                "method": "POST",
                "host": "api.atlassian.com",
                "port": 443,
                "path": "/jsm/ops/integration/v1/json/eswatcher",
                "headers": {
                    "Content-Type" : "application/json"
                },
                "params": {
                    "apiKey": "<span>{{itgs.temp.apiKey}}</span>"
                },
                "body": "<span ng-non-bindable>{{#toJson}}ctx{{/toJson}}</span>"
            }
        }
    }
}

Acknowledge alerts in X-Pack Alerting

Set the integration to automatically acknowledge an alert in X-Pack Alerting when the alert is acknowledged in Jira Service Management.

Select the Acknowledge alerts in X-Pack Alerting checkbox in the Outgoing section of the integration configuration page.
Edit the integration settings and select Authenticate with an X-Pack Alerting account. Set the following values:
1. Enter the action ID into X-Pack Alerting Action Id.
2. Enter your X-Pack Alerting host URL into X-Pack Alerting Host URL. Specify the full URL address as [protocol]://yourserveraddr:[port]. For example: http://yourserver.com:9200
Select Save.

Sample payload

(in JSON format)

{
  "id": "event_critical_watch_249-2016-09-28T11:31:05.955Z",
  "vars": {},
  "trigger": {
    "triggered_time": "2016-09-28T11:31:05.955Z",
    "scheduled_time": "2016-09-28T11:31:05.511Z"
  },
  "execution_time": "2016-09-28T11:31:05.955Z",
  "watch_id": "event_critical_watch",
  "payload": {
    "hits": {
      "total": 1,
      "hits": [
        {
          "_type": "event",
          "_source": {
            "eventDescription": "System has detected 3 failed login attempts",
            "eventId": 1,
            "eventName": "3 failed login attempts",
            "eventType": "LOG",
            "eventCategory": "CRITICAL"
          },
          "_id": 1,
          "_index": "event",
          "_score": 0.30685282
        }
      ],
      "max_score": 0.30685282
    },
    "_shards": {
      "total": 1,
      "failed": 0,
      "successful": 1
    },
    "timed_out": false,
    "took": 1
  },
  "metadata": "null"
}

Was this helpful?

It wasn't accurate

It wasn't clear

It wasn't relevant

Still need help?

The Atlassian Community is here for you.

Ask the Community