Make custom webhook host supports IP address as well

[adityaj1107]

Issue by raymanound Sunday Dec 29, 2019 at 17:02 GMT Originally opened as https://github.com/opendistro-for-elasticsearch/alerting/issues/137

---

Hi, I have a use case that sending request to localhost with data but the host in custom attributes URL does not accept either "localhost" or "127.0.0.1". Can you consider to make it accept those values? Thanks.

[adityaj1107]

Comment by dbbaughe Monday Apr 20, 2020 at 23:39 GMT

---

Hi @raymanound,

Were you able to get around this by using the API to create the destination? Just curious if this is issue purely in the Kibana plugin or both.

[adityaj1107]

Comment by H1L021 Sunday May 17, 2020 at 23:28 GMT

---

hello @dbbaughe I have this same limitation. I wanna send alerts to TheHive with custom webhooks but i can't use IPs addresses. I defined the TheHive server IP and mapped it with a domain name in the /etc/hosts file. When I use the same command from the opendistro node to thehive node it works fine and create the alerts. However, when i defined it in the kibana alerting plugin and created an alert, I got this error message :

"alert_history" : [
            {
              "timestamp" : 1589756179815,
              "message" : """Error running action:
java.net.UnknownHostException: thehive.hidden.org: Name or service not known"""
            }
          ], 

I was wondering what is the domain resolution mechanism the alerting plugin is using since it works with curl and not with it.

[Big-al]

This is just a problem with the Kibana UI identifying the field as URL only. Using the alerting api, you can create destinations with IP addresses as well:

POST _opendistro/_alerting/destinations { "type": "custom_webhook", "name": "Logstash, Test pipeline", "custom_webhook": { "path": "/", "header_params": { "Content-Type": "application/json" }, "scheme": "HTTP", "port": 8378, "query_params": { "token": "Test" }, "host": "10.100.10.10" } }

Resulting in: { "_id" : "GWYfp3wBxNPfRThrCYXi", "_version" : 1, "_seq_no" : 1, "_primary_term" : 1, "destination" : { "type" : "custom_webhook", "name" : "Logstash, Test pipeline", "schema_version" : 2, "last_update_time" : 1634891401694, "custom_webhook" : { "path" : "/", "header_params" : { "Content-Type" : "application/json" }, "password" : null, "scheme" : "HTTP", "port" : 8378, "query_params" : { "token" : "Test" }, "host" : "10.100.10.10", "url" : null, "username" : null } } }

And is displayed in Kibana as such:

[adamdepollo]

Comment by H1L021 Sunday May 17, 2020 at 23:28 GMT

hello @dbbaughe I have this same limitation. I wanna send alerts to TheHive with custom webhooks but i can't use IPs addresses. I defined the TheHive server IP and mapped it with a domain name in the /etc/hosts file. When I use the same command from the opendistro node to thehive node it works fine and create the alerts. However, when i defined it in the kibana alerting plugin and created an alert, I got this error message :

"alert_history" : [
            {
              "timestamp" : 1589756179815,
              "message" : """Error running action:
java.net.UnknownHostException: thehive.hidden.org: Name or service not known"""
            }
          ], 

I was wondering what is the domain resolution mechanism the alerting plugin is using since it works with curl and not with it.

Not exactly the same issue, but I have the same question. I am trying to create a destination to generate Gitlab EE alerts from OpenSearch notifications.

Gitlab EE generated a URL and auth token for the webhook, and I'm able to successfully curl to the webhook URL and create alerts in Gitlab that way.

However, trying to hit this URL from OpenSearch I am getting the same error: java.net.UnknownHostException: gitlab.mydomain.internal: Name or service not known

To double check it wasn't some networking issue I created a test EC2 instance in the same security group as my OpenSearch domain and had no issues hitting the webhook from curl on the instance.

So what is the domain resolution mechanism?

[MichelMan]

+1 I have the same issue. @adamdepollo did you find a way to figure out your issue with OpenSearch and Gitlab alert?