Fairly new to StackStorm. Trying to integrate a use case where Splunk is sending a webhook based on a particular patern over to StackStorm.
When i try to create a rule with the following, the “action” piece is not being performed.
---
name: "sample_rule_with_webhook"
pack: "examples"
description: "Sample rule dumping webhook payload to a file."
enabled: true
trigger:
type: "core.st2.webhook"
parameters:
url: "splunk_test"
criteria: {}
trigger.body.name:
pattern: "Start*"
type: "matchwildcard"
action:
ref: "core.local"
parameters:
cmd: "echo \"{{trigger.body}}\" >> ~/st2.webhook_sample.out ; sync"
I can see trigger in st2 trigger-instance list and shows processed. In the rule logs i see the following:
2018-03-12 10:38:10,623 140227477546480 ERROR filter [-] There might be a problem with the criteria in rule RuleDB(action=ActionExecutionSpecDB@140227478157136(ref="core.local", parameters="{u'cmd': u'echo "{{trigger.body}}" >> ~/st2.webhook_sample.out ; sync'}"), criteria={u'trigger.body.name': {u'pattern': u'Starting', u'type': u'contains'}}, description="Splunk testing", enabled=True, id=5aa15c4c77848358ca3b36d6, name="splunk_test", pack="default", ref="default.splunk_test", tags=[], trigger="core.74017ce9-b665-4356-b8ca-bdf225786950", type=RuleTypeSpecDB@140227478354896(ref="standard", parameters="{}"), uid="rule:default:splunk_test").
Traceback (most recent call last):
File "/opt/stackstorm/st2/lib/python2.7/site-packages/st2reactor/rules/filter.py", line 145, in _check_criterion
result = op_func(value=payload_value, criteria_pattern=criteria_pattern)
File "/opt/stackstorm/st2/lib/python2.7/site-packages/st2common/operators.py", line 159, in contains
return criteria_pattern in value
TypeError: argument of type 'NoneType' is not iterable (_trigger_instance={'status': 'processing', 'occurrence_time': '2018-03-12 14:38:10.553211+00:00', 'trigger': u'core.74017ce9-b665-4356-b8ca-bdf225786950', 'id': '5aa690d2778483595ab63325', 'payload': {'body': {u'results_link': u'https://abc.123.local:8000/app/search/search?q=%7Cloadjob%20rt_scheduler__john_YWxlcnRfbG9nZXZlbnQ__testing_at_1520860980_24219.409_2D6D92F7-0525-41CB-909C-FA732D025C1A%20%7C%20head%201%20%7C%20tail%201&earliest=0&latest=now', u'app': u'alert_logevent', u'search_name': u'testing', u'result': {u'_si': [u'abc.123.local', u'os'], u'_confstr': u'source::/var/log/messages|host::abc00006|syslog', u'_time': u'1521198257', u'host': u'hlp00006', u'_sourcetype': u'syslog', u'_indextime': u'1520865490', u'_raw': u'Mar 16 07:04:17 hlp00006 systemd[1]: Starting Session 2050 of user root.', u'_serial': u'96'}, u'sid': u'rt_scheduler__john_YWxlcnRfbG9nZXZlbnQ__testing_at_1520860980_24219.409_2D6D92F7-0525-41CB-909C-FA732D025C1A', u'owner': u'john'}, 'headers': {'X-Request-Id': 'afe33463-6ceb-4960-a9b9-c7627b381dd0', 'Accept-Encoding': 'identity', 'X-Forwarded-For': '10.00.000.232', 'Content-Length': '763', 'User-Agent': 'Splunk/2D6D92F7-0525-41CB-909C-FA732D025C1A', 'Host': '123,123', 'X-Real-Ip': '10.27.248.232', 'Content-Type': 'application/json'}}},_trigger={'uid': u'trigger:core:74017ce9-b665-4356-b8ca-bdf225786950:feec5050a7553f359ba5ff7624f093c8', 'parameters': {u'url': u'splunk_test'}, 'ref': u'core.74017ce9-b665-4356-b8ca-bdf225786950', 'ref_count': 1, 'name': u'74017ce9-b665-4356-b8ca-bdf225786950', 'pack': u'core', 'type': u'core.st2.webhook', 'id': '5aa15c4977848358ca3b36d5', 'description': None},_rule={'description': u'Splunk testing', 'tags': [], 'ref': u'default.splunk_test', 'enabled': True, 'name': u'splunk_test', 'trigger': u'core.74017ce9-b665-4356-b8ca-bdf225786950', 'criteria': {u'trigger.body.name': {u'pattern': u'Starting', u'type': u'contains'}}, 'action': 'ActionExecutionSpecDB@140227478157136(ref="core.local", parameters="{u\'cmd\': u\'echo "{{trigger.body}}" >> ~/st2.webhook_sample.out ; sync\'}")', 'pack': u'default', 'type': 'RuleTypeSpecDB@140227478354896(ref="standard", parameters="{}")', 'id': '5aa15c4c77848358ca3b36d6', 'uid': u'rule:default:splunk_test'})
2018-03-12 10:38:10,632 140227477546480 INFO matcher [-] 0 rule(s) found to enforce for 74017ce9-b665-4356-b8ca-bdf225786950.
2018-03-12 10:38:10,632 140227477546480 INFO engine [-] Matched 0 rule(s) for trigger_instance 5aa690d2778483595ab63325 (trigger=core.74017ce9-b665-4356-b8ca-bdf225786950)
2018-03-12 10:38:10,632 140227477546480 INFO engine [-] No matching rules found for trigger instance 5aa690d2778483595ab63325.
Any advice would be greatly appreciated.