Category Archives for Tutorials

New in StackStorm 2.5: Real-time action output streaming

November 07, 2017
by Tomaz Muraus

StackStorm v2.5.0 has been released recently. In addition to Inquiries, it includes another widely requested feature – real-time output of actions.

Real-time action output streaming allows users to see any output produced by an action in real-time.

This makes troubleshooting and debugging actions much easier and faster. It is especially handy in environments where StackStorm is used as a CI / CD tool and for long running actions (do you have a long running action which builds and installs a software package and you want to see the progress in real-time? Now that and a lot more is possible).

Prior to this release, it was only possible to see the output once the action has finished (well, there were some workarounds which involved using “tail” command, but those workarounds had many limitations and issues).


New in StackStorm 2.5: Inquiries

October 31, 2017
by Matt Oswalt

StackStorm 2.5  introduces one of our most highly requested features: “Inquiries”. Inquiries are a way of “asking a question” in the middle of a workflow (Mistral or ActionChain), to get additional data before moving on.

For instance, while you can store service credentials in the StackStorm datastore and retrieve them using a Jinja snippet, some services require two-factor authentication. It’s necessary, therefore, to be able to pause the workflow at a certain point, and allow a human to “inject” this data into the workflow midstream. There are a number of other use cases for this functionality, including the simple “I’m about to do something stupid dangerous, should I proceed?”.

Before we get into Inquiries and how they work, an important note: we’ve been working hard on making sure the new feature is useful for a variety of use cases, and as robust as possible. However, it is a complex and fairly low-level feature that has a lot of moving parts, and before recommending it for production use, we’d like to spend a release cycle gathering feedback on the API and the user experience. So, for 2.5, we would love for you to use this feature in your test/dev deployments of StackStorm and let us know what you think. Don’t worry, this is not going to stay “alpha” forever! We expect that it will be “production ready” in StackStorm 2.6, due to ship later this year.


StackStorm Centralized Logging with Graylog

August 22, 2017
By Nick Maludy of Encore Technologies

Want to implement centralized logging for your StackStorm deployment? Read on to find out how to send your StackStorm logs to Graylog, and produce pretty dashboards like this:


Installing StackStorm on Offline Systems

Feb 10, 2017
by Siddharth Krishna

Want to install StackStorm on a machine that doesn’t have access to the internet? If you’ve got another box on your local network that connects to the public network, you can do this by making it a local package repository server. In this post, we’ll walk you through steps for setting up an apt-mirror server with the required packages and configuring the offline client machine to quickly get a full StackStorm installation up and running!


Event Driven Auto-Remediation with the Elastic Stack

Jan 12, 2017
by Siddharth Krishna

Recently we explained how to use Syslog with Splunk & StackStorm to auto-remediate a link going down on a switch. Splunk is a widely used log management tool but there’s also a popular open source alternative – Elastic Stack (formerly the ELK Stack: Elasticsearch, Logstash and Kibana). So if you’re using the Elastic Stack, and are looking to automate event remediation in your environment, you’re at the right place! In this post, we’re taking the same use case as before and talking about how to set up the Elastic stack to collect syslog data and trigger event-based network remediation workflows using StackStorm.


Execution Time for ChatOps commands

November 7, 2017
by Eugen C. aka @armab

Did you know you can do something like this with StackStorm ChatOps?
ChatOps Command Execution time

Looks simple, but it’s a very useful thing to have in your ChatOps toolset, especially for potentially long-running commands.

Auto-Remediation with StackStorm & Splunk

Oct 21, 2016
by Siddharth Krishna

Splunk is a great tool for collecting and analyzing log data. StackStorm is a great tool for automated event-driven remediation. So what happens when we stick them together? Here’s how to use Splunk to collect syslog data and trigger event-based network remediation workflows using StackStorm!


How to Troubleshoot a Rule

Sep 20, 2016
by Dmitri Zimine

I set up a sensor to watch for a trigger (trigger represents an external event; sensor will fire a trigger-instance of the trigger type when the event is detected). I created a rule: if the trigger happens, and matches the criteria, it should fire an action. I see that event had happened. I expected the actions to fire. But it didn’t happen. Where did it break?

This is a long read, and may look complicated. But really, it’s just three debugging steps. And it’s long because I refuse to write briefly, drop bunch of hints on the way and get you distracted. But as they say in math, the thicker the math book the faster it reads. Brace yourself.

In the example below, I’ll be showing you how we debugged our Twitter automation that scans tweets for mentions and posts it to Slack. A pretty good way to keep track on who is trash talking about us! The debugging “runbook” is generic and applies to troubleshooting other rules just fine.

First, let’s look at the trigger chain and review how it works.


Cisco Spark integration for StackStorm

March 22, 2016
by Anthony Shaw of Dimension Data

I’m “pretty excited” to share some news, we’ve just finished integrating Cisco Spark into StackStorm, via our automation-bot, Hubot.
This means you can get all of the power of StackStorm chatops from within Cisco Spark rooms and collaboration experiences.

What is Cisco Spark?

Cisco Spark delivers cloud-based business communications that enables customers to message, meet and call anyone, whether it be on their mobile device, desktop or meeting room end-points.

What is StackStorm?

StackStorm is an event-driven automation platform that ties together every component of your environment. It’s commonly used for auto-remediation—including response to security events—and other cases such as complex deployments.

Configuring Cisco Spark

If you don’t already have a Cisco Spark account, you can sign up at

Once you have signed up, go to and sign in, then you should be able to generate a key


Improvements to ChatOps Pack Development User Story in ST2 1.4dev

February 15, 2016
by Jon Middleton, Optimisation Project Lead @ Pulsant Limited

In the post StackStorm QuickTip: ChatOps your pack dev workflow James Fryman gave a ChatOPS alias recipe to reduce the friction for deploying packs and then in the Random Thoughts section asked:

This action is tied directly to the packs.install. What about a workflow? Seems like that would be a better way to structure this.

This resonated with me as I had already started working on an internal pack that did just that, as I thought attempting to deploy a pack via an alias (and action) contained within the same pack would be madness (or just lead to interesting race conditions). In the last week, our Pull Request has been merged, documentation has been included in st2docs (link) for a workflow that fulfils the above random thought and should be released with 1.4.

So introducing packs.deploy, an action written in Mistral to handle the mapping of names for Git repositories to the information required to carry out the packs.install action.



1 2 3