Elastic Cloud - ELK Stack

This document shows you how you can integrate Callgoose SQIBS with Elastic Cloud - ELK Stack.

Incidents will be creating in Callgoose SQIBS when there is a incident created in Elastic Cloud as per the Alert rule configured by you in the Elastic Cloud

In Callgoose SQIBS

 Create filter  as per the Elastic Cloud workflows.

• For test purpose, create an API filter like this

In Elastic Cloud

1. Log in to the Elastic Cloud Dashboard, and on the top search bar, Search for Alerts and Insights. Choose Rules and Connectors Click on Connectors Click on Create connector

2. Scroll down and Choose Webhook

Fill the following Webhook connectorConnector name: Callgoose SQIBS Connector settings: Method: POST

URL : https://xxxxxxx.callgoose.com/sqibs-api/v1/process?from=ElasticCloudELKStack&token=dTsYgIyXeKz6UIAZ8qE6ik
juh3245234532ogfsbdm5WB0ff8yBzKtkze

Click on Add HTTP header

key Content-Type

Value application/json

Authentication Require authentication for this webhook should be uncheckedClick on Test tab in the same window

Create an action Body: { "Elastic Test": "Critical : CPU Usage is high on cloudvm01"  } Run the testClick on Run

4. You can see the message Test was successful. Click on Save & close

You can see the Callgoose SQIBS in Connectors

5. You can also see that this test notification created an incident in Callgoose SQIBS.

6. How you use this “Callgoose SQIBS” Connector in “Elastic Cloud” Click on Rules Tab Click on Create rule Tab

7. Name: CPU Usage check on cloudvm01 Notify Choose Every time alert is active Search Rule TypeSearch CPU or scroll down the page and choose CPU Usage as a rule type CPU Usage Notify when CPU is over: Choose 90 % Look at the average over: Choose 5 Minutes

Actions Select a connector type,

Choose Webhook Webhook Connector ,

Choose Callgoose SQIBS

Here we are adding the below variable in Json format

{
  "Date": "{{date}}",
  "Rule Type": "{{rule.type}}",
  "Rule Tag": "{{rule.tags}}",
  "Rule Space Id": "{{rule.spaceId}}",
  "Rule Name": "{{rule.name}}",
  "Rule Id": "{{rule.id}}",
  "Context State": "{{context.state}}",
  "Content Node": "{{context.node}}",
  "Content Short Msg": "{{context.internalShortMessage}}"
  "Content Cluster Name": "{{context.clusterName}}"
  "Content Action Plan": "{{context.actionPlain}}"
  "Content Action": "{{context.action}}"
  "Kibana Base Url": "{{kibanaBaseUrl}}"
}

Run When Choose Default

Scroll down and choose Webhook again.

Webhook Connector , Choose Callgoose SQIBS

now we are going to create Rule for Recovered

'Run When' Choose Recovered.

Here we are adding the below variable in Json format in Recovered Rule Webhook Body too Click on Save

{
  "Date": "{{date}}",
  "Rule Type": "{{rule.type}}",
  "Rule Tag": "{{rule.tags}}",
  "Rule Space Id": "{{rule.spaceId}}",
  "Rule Name": "{{rule.name}}",
  "Rule Id": "{{rule.id}}",
  "Context State": "{{context.state}}",
  "Content Node": "{{context.node}}",
  "Content Short Msg": "{{context.internalShortMessage}}"
  "Content Cluster Name": "{{context.clusterName}}"
  "Content Action Plan": "{{context.actionPlain}}"
  "Content Action": "{{context.action}}"
  "Kibana Base Url": "{{kibanaBaseUrl}}"
}

You can see the newly created Rule in Rules