Open pugnascotia opened 5 days ago
Pinging @elastic/response-ops (Team:ResponseOps)
A couple of notes:
Producing a table from a ES Query hits
might be nice, perhaps taking an array as suggested in the top comment, and also indicating which fields you wanted picked out, maybe also in the order they should be in the table.
ES|QL data should be a natural here
Presumably this will be used to create "textual" tables, since Slack has absolutely NO support for tables in MrkDwn or BlockKit, but for email, we could create an actual HTML table
We would also probably want a way to "construct" a table, with a mustache section iterating over rows. Perhaps this would be possible by using a "table lambda" over an Hjson lambda, that created the JSON. But I was also thinking of supporting something like GHF Markdoown tables - https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/organizing-information-with-tables
We could likely also use real box chars, like (mostly) this. I think all the connectors are available ...
┌─────────+─────────────────+────────────────┐
│ foo │ bar │ baz │
+─────────┼─────────────────┼────────────────+
│ value │ another value │ etc │
+─────────┼─────────────────┼────────────────+
│ value 2 │ yet another val │ blah blah blah │
└─────────+─────────────────+────────────────┘
Describe the feature:
Add support to Mustache template processing e.g. another lambda that renders tabular data as a text table.
Describe a specific use case for the feature:
I'm writing an alert based on an Elasticsearch query, and if any records are found then I was to include them in the alert body as a table. The output of the alert will be Slack messages, but Slack has no support for tables, so I want to format my results as a table (I'm using ES|QL and picking just a few fields).
For example, results like the following (only structured like an Elasticsearch result set):
Would yield: