Symptom

A Cribl Stream notification is created successfully, but the notification does not appear in the configured Discord channel.

The Cribl notification service logs report an HTTP 400 response similar to the following:

{
  "level": "error",
  "message": "Request failed",
  "reason": "Received status code=400, method=POST",
  "response": "{\"message\":\"The request body contains invalid JSON.\",\"code\":50109}",
  "statusCode": 400
}

Environment

• Product: Cribl Stream

• Feature: Notifications

• Target type: Webhook

• Destination: Discord Incoming Webhook

• Notification configured on a REST Source

Resolution

Configure the Webhook notification target to send the notification in the JSON structure expected by Discord.

1. In Cribl Stream, navigate to Notifications and select the Targets tab.

2. Edit the Webhook notification target used for Discord.

3. Confirm that URL contains the complete Discord webhook URL.

4. Configure the target with the following settings:

   • Method: POST

   • Format: Custom

   • Source expression:

JSON.stringify({content: _raw})

• Event delimiter: Leave blank

• Content type: application/json

5. Under Advanced Settings, set Events-per-request limit to 1.

Discord expects each request body to contain a single message object. Limiting each request to one event prevents multiple JSON objects from being combined into an invalid request body.

6. Save the notification target.

7. Trigger a test notification.

8. Verify that the notification appears in the Discord channel.

The resulting request body will resemble the following:

{
  "content": "Source collection:api-alerts in group shared-services had no traffic for 1m"
}

Cause

By default, a Cribl Stream Webhook notification target sends events in NDJSON format. This includes the complete notification event as a raw JSON object.

Discord does not accept the default Cribl notification event structure as a webhook message. Discord requires the request to contain at least one supported message field, such as content, embeds, components, file, or poll.

For a basic text notification, Discord expects the following structure:

{
  "content": "Your message here"
}

The custom Source expression uses JSON.stringify() to place the Cribl notification’s _raw value inside the required content property and produce valid JSON.

Additional Information

• Treat the complete Discord webhook URL as a credential. Anyone with access to it can potentially post messages to the associated channel.

• Discord limits the content field to 2,000 characters.

• If notification content can include user-controlled text, consider Discord’s allowed_mentions setting to prevent unexpected user or role mentions.

• See Cribl Webhook Notification Targets for information about custom formats, Source expressions, batching, and request limits.

• See the Discord Webhook documentation for supported request fields and message limits.