Integrate with X-Pack Alerting

Overview

What does the integration offer?

Use the X-Pack Alerting Integration to forward X-Pack Alerting alerts to Jira Service Management. Jira Service Management acts as a dispatcher for these alerts and determines the right people to notify based on on-call schedules– notifies via email, text messages (SMS), phone calls, and iPhone & Android push notifications, and escalates alerts until they are acknowledged or closed.

Functionality of the integration

When an alert is fired by X-Pack Alerting, an alert is created in Jira Service Management automatically through the integration.
When the alert is acknowledged in Jira Service Management, the alert is acknowledged in X-Pack Alerting.

Add X-Pack Alerting integration

You can add this integration from your team dashboard

If you're using Opsgenie's Free or Essentials plan, or if you’re using Opsgenie with Jira Service Management's Standard plan, you can only add this integration from your team dashboard as the Integrations page under Settings is not available in your plan.

Adding the integration from your team dashboard will make your team the owner of the integration. This means Opsgenie will assign the alerts received through this integration to your team only.

To do that,

Go to your team’s dashboard from Teams,
Select Integrations, and select Add integration.

Follow the rest of the steps to complete the integration.

To add an X-Pack Alerting integration in Jira Service Management:

Go to your team’s operations page.
On the left navigation panel, select Integrations and then Add integration.
Run a search and select “X-Pack Alerting”.
On the next screen, enter a name for the integration.
Optional: Select a team in Assignee team if you want a specific team to receive alerts from the integration.
Select Continue.
The integration is saved at this point.
Expand the Steps to configure the integration section and copy the API key.
You will use this key while configuring the integration in X-Pack Alerting later.
Copy the code provided in the "Configure the integration in X-Pack Alerting" section of this article.
Select Turn on integration.
The rules you create for the integration will work only if you turn on the integration.

Configure the integration in X-Pack Alerting

Paste the code you copied while adding the integration in Jira Service Management in Elasticsearch.
Configure alert settings in X-Pack Alerting.
For more information about X-Pack Alerting, refer to X-Pack Alerting Documentation.
Paste the API key you copied while adding the integration in Jira Service Management into [YOUR API KEY].

JSON

PUT _watcher/watch/[WATCH ID]
{
    [OTHER CONFIGURATIONS OF YOUR X-PACK ALERTING ALERT]
    .
    .
    .
    .
    .

    "actions" : {
        "opsgenie" : {
            "webhook" : {
                "scheme" : "https",
                "method" : "POST",
                "host" : "api.opsgenie.com",
                "port" : 443,
                "path" : "/v1/json/eswatcher",
                "headers" : {
                    "Content-Type" : "application/json"
                },
                "params": {
                    "apiKey": "[YOUR API KEY]"
                },
                "body" : "{{#toJson}}ctx{{/toJson}}"
            }
        }
    }
}

Optional: Acknowledging alerts in X-Pack Alerting

Set the integration to automatically acknowledge an alert in X-Pack Alerting, when the alert is acknowledged in Jira Service Management.
In order to do this, select "Acknowledge Alerts in X-Pack Alerting" option in integration settings.
Fill in the following two fields:
1. Fill "X-Pack AlertingAction ID" field with your Action ID.
2. Fill "X-Pack Alerting Host URL" field with the URL address.
Specify the full URL address as [protocol]://yourserveraddr:[port]. For example: http://yourserver.com:9200

Sample payload

In JSON format

{
  "id": "event_critical_watch_249-2016-09-28T11:31:05.955Z",
  "vars": {},
  "trigger": {
    "triggered_time": "2016-09-28T11:31:05.955Z",
    "scheduled_time": "2016-09-28T11:31:05.511Z"
  },
  "execution_time": "2016-09-28T11:31:05.955Z",
  "watch_id": "event_critical_watch",
  "payload": {
    "hits": {
      "total": 1,
      "hits": [
        {
          "_type": "event",
          "_source": {
            "eventDescription": "System has detected 3 failed login attempts",
            "eventId": 1,
            "eventName": "3 failed login attempts",
            "eventType": "LOG",
            "eventCategory": "CRITICAL"
          },
          "_id": 1,
          "_index": "event",
          "_score": 0.30685282
        }
      ],
      "max_score": 0.30685282
    },
    "_shards": {
      "total": 1,
      "failed": 0,
      "successful": 1
    },
    "timed_out": false,
    "took": 1
  },
  "metadata": "null"
}