Opsgenie - using fields in opsgenie_message

[RaulPastorClemente]

Greetings,

I'm trying to customize the opsgenie message to something different to the rule name by adding something in the lines of opsgenie_message: "New alert: {kibana.alert.rule.name}"

Not really sure if that's correct, but according to the documentation:
opsgenie_message: Set the OpsGenie message to something other than the rule name. The message can be formatted with fields from the first match e.g. “Error occurred for {app_name} at {timestamp}.”.

When I try to test the alert with the command elastalert-test-rule rules/opsgenie.xml --days 4 --alert so it can find a match, I get the following error:

ERROR:elastalert:Traceback (most recent call last):
  File "/usr/local/lib/python3.11/site-packages/elastalert/elastalert.py", line 1299, in alert
    return self.send_alert(matches, rule, alert_time=alert_time, retried=retried)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/elastalert/elastalert.py", line 1376, in send_alert
    alert.alert(matches)
  File "/usr/local/lib/python3.11/site-packages/elastalert/alerters/opsgenie.py", line 70, in alert
    self.message = self.custom_message.format(**matches[0])
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
KeyError: 'kibana'

ERROR:elastalert:Uncaught exception running rule siem-to-opsgenie: 'kibana'
{"hits": 1, "days": 4, "terms": ["kibana.version", "kibana.alert.rule.category", "kibana.alert.rule.consumer", "kibana.alert.rule.execution.uuid", "kibana.alert.rule.name", "kibana.alert.rule.producer", "kibana.alert.rule.rule_type_id", "kibana.alert.rule.uuid", "kibana.space_ids", "kibana.alert.rule.tags", "@timestamp", "event.kind", "kibana.alert.original_time", "kibana.alert.ancestors", "kibana.alert.status", "kibana.alert.workflow_status", "kibana.alert.depth", "kibana.alert.reason", "kibana.alert.severity", "kibana.alert.risk_score", "kibana.alert.rule.parameters", "kibana.alert.rule.actions", "kibana.alert.rule.author", "kibana.alert.rule.created_at", "kibana.alert.rule.created_by", "kibana.alert.rule.description", "kibana.alert.rule.enabled", "kibana.alert.rule.exceptions_list", "kibana.alert.rule.false_positives", "kibana.alert.rule.from", "kibana.alert.rule.immutable", "kibana.alert.rule.interval", "kibana.alert.rule.indices", "kibana.alert.rule.license", "kibana.alert.rule.max_signals", "kibana.alert.rule.note", "kibana.alert.rule.references", "kibana.alert.rule.risk_score_mapping", "kibana.alert.rule.rule_id", "kibana.alert.rule.severity_mapping", "kibana.alert.rule.threat", "kibana.alert.rule.to", "kibana.alert.rule.type", "kibana.alert.rule.updated_at", "kibana.alert.rule.updated_by", "kibana.alert.rule.version", "kibana.alert.rule.meta.from", "kibana.alert.rule.meta.kibana_siem_app_url", "kibana.alert.rule.risk_score", "kibana.alert.rule.severity", "kibana.alert.threshold_result", "kibana.alert.uuid"], "result": {<removed as contains sensitive information>}, "sort": [1676721936645]}], "writeback": {"silence": {"exponent": 0, "rule_name": "siem-to-opsgenie", "@timestamp": "2023-02-21 13:53:21.664108+00:00", "until": "2023-02-21 14:23:21.664099+00:00"}, "elastalert_error": {"message": "Uncaught exception running rule siem-to-opsgenie: 'kibana'", "traceback": ["Traceback (most recent call last):", "  File \"/usr/local/lib/python3.11/site-packages/elastalert/elastalert.py\", line 1299, in alert", "    return self.send_alert(matches, rule, alert_time=alert_time, retried=retried)", "           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^", "  File \"/usr/local/lib/python3.11/site-packages/elastalert/elastalert.py\", line 1376, in send_alert", "    alert.alert(matches)", "  File \"/usr/local/lib/python3.11/site-packages/elastalert/alerters/opsgenie.py\", line 70, in alert", "    self.message = self.custom_message.format(**matches[0])", "                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^", "KeyError: 'kibana'"], "data": {"rule": "siem-to-opsgenie"}}, "elastalert_status": {"rule_name": "siem-to-opsgenie", "endtime": "2023-02-21 13:53:19.773942+00:00", "starttime": "2023-02-17 13:53:19.773942+00:00", "matches": 1, "hits": 1, "@timestamp": "2023-02-21 13:53:21.665955+00:00", "time_taken": 1.7653000354766846}}}

Any idea of why is it failing?

[nsano-rururu]

Yelp/elastalert#2288

[RaulPastorClemente]

I had to debug it a bit, but it seems like the match dictionary only goes down one level.

I see what the problem is. Thank you very much!