Send Text-Only Email Alert from Signals Watch

[Doug_Renze]

Title says it all. Is it possible to configure Signals to send a text-only email alert, with no HTML content? I attempted to just leave the HTML content blank, which gave me no text when I attempted to view the email in Outlook. I would prefer to be able to set this at the email account level, rather than for each individual alert, if it’s possible.

Plaintext is our preferred format, as we will frequently be ingesting emailed alerts into other applications.

Elastic Stack 7.10.1/SG 49.0.0.

[nils]

Good point. I have filed an issue for this: Signals E-Mail action: Allow disabling of HTML body (#321) · Issues · search-guard / search-guard-kibana-plugin · GitLab

Right now, there would be one workaround available, which is however a bit cumbersome:

Get the raw JSON definition of the watch by REST API:

curl -k -u $USERNAME:$PASSWORD 'https://elasticsearch:9200/_signals/watch/_main/your_watch_id'

Edit the returned JSON, and remove this attribute:

"html_body": "",

Update the watch:

curl -k -u $USERNAME:$PASSWORD -X PUT -H "Content-Type: application/json" -T '/path/to/the/updated/watch.json' 'https://elasticsearch:9200/_signals/watch/_main/your_watch_id'

[Doug_Renze]

@nils

Get the raw JSON definition of the watch by REST API:

curl -k -u $USERNAME:$PASSWORD 'https://elasticsearch:9200/_signals/watch/_main/your_watch_id'

Edit the returned JSON, and remove this attribute:

"html_body": "",

Thanks. Just tested it, and it works (almost) perfectly. The only issue is that if someone goes back in, makes any adjustments at all, and then hits “update,” it saves the default HTML alert body, and you’ve got to go back in to delete it.

Thanks for creating the issue.