Kibana Watcher to Slack call resulting in 400

Question

I have setup a Kibana watcher, which should send a slack message to a channel when the condition is fulfilled. Watcher seems to be working fine, it is able to query the logs, get the hits, prepare the payload for posting message to Slack channel. But the call to slack is resulting in 400 error (invalid payload), while when the same payload is tried through postman, seems to be fine. (The only difference is in Kibana watcher, body json for slack POST call is considered as String, whereas, when trying through the postman, I have to use the parsed json object).

Watcher Action:

"condition": {
        "compare": {
          "ctx.payload.hits.total": {
            "gt": 0
          }
        }
    },
    "actions": {
        "send_trigger": {
          "throttle_period_in_millis": 60000,
          "transform": {
            "script": {
              "source": "def payload = ctx.payload; def msgData = ctx.payload.hits.hits.0._source.message.replace('\"', ''); msgData = msgData.replace('\\', ''); payload.msg = msgData; return payload;",
              "lang": "painless"
            }
          },
          "webhook": {
            "scheme": "https",
            "host": "hooks.slack.com",
            "port": 443,
            "method": "post",
            "path": "/services/********/*********/******************",
            "params": {},
            "headers": {
              "Content-type": "application/json"
            },
            "body": "{\"channel\": \"alert-channel-name\",\"username\": \"slackKibanaUser\",    \"attachments\": [ { \"color\": \"danger\", \"title\": \" Alert Title For Event Occurance \", \"title_link\" : \"https://kibana.whatever.biz.com/app/kibana\", \"text\": \" *Detail:* \n ``` {{ ctx.payload.msg}} \n ``` \", \"fields\": [ {\"title\": \"Traceid\", \"value\": \"`{{ ctx.payload.hits.hits.0._source.traceId}}`\", \"short\": true}, { \"title\": \"Environment\", \"value\": \"{{ctx.payload.hits.hits.0._source.fields.environment}}\", \"short\": false }], \"footer\": \"{{ctx.payload.hits.hits.0.fields.environment}}\", \"footer_icon\": \"https://platform.slack-edge.com/img/default_application_icon.png\" }]} "
          }
        }
    }

The response recorded in watcher error:

"reason": "received [400] status code",
        "webhook": {
          "request": {
            "host": "hooks.slack.com",
            "port": 443,
            "scheme": "https",
            "method": "post",
            "path": "/services/********/*********/******************",
            "headers": {
              "Content-type": "application/json"
            },
            "body": "{\"channel\": \"alert-channel-name\",\"username\": \"slackKibanaUser\",    \"attachments\": [ { \"color\": \"danger\", \"title\": \" Alert Title For Event Occurance \", \"title_link\" : \"https://kibana.whatever.biz.com/app/kibana\", \"text\": \" *Detail:* \n ``` 2020-05-28T00:00:00.000Z\tsome-random-numbers \tERROR\tInvoke Error\t{errorType:MyCustomError,errorMessage:{\\errorMessage\\:\\Something went wrong while processing : More error details goes here.\\,\\payload\\:\\[id=undefined, key1=value1, key2=value2, timestampRecorded=12/10/2019, 02:00:00, timestampActual=12/10/2019, 01:59:00, key3=value3, key4=v:a:l:u:e:4, key5=v:a:l:u:e:5]\\},name:MyCustomError,stack:[MyCustomError: {\\errorMessage\\:\\Something went wrong while processing : More error details goes here.\\,\\payload\\:\\[id=undefined, key1=value1, key2=value2, timestampRecorded=12/10/2019, 02:00:00, timestampActual=12/10/2019, 01:59:00, key3=value3, key4=v:a:l:u:e:4, key5=v:a:l:u:e:5]\\},    at Runtime.exports.functionOne (/var/task/index.js:49:9)]} \n ``` \", \"fields\": [ {\"title\": \"Traceid\", \"value\": \"``\", \"short\": true}, { \"title\": \"Environment\", \"value\": \"test-env\", \"short\": false }], \"footer\": \"\", \"footer_icon\": \"https://platform.slack-edge.com/img/default_application_icon.png\" }]} "
          },
          "response": {
            "status": 400,
            "headers": {
                ...
              "referrer-policy": [
                "no-referrer"
              ],
              "connection": [
                "keep-alive"
              ],
              "content-type": [
                "text/html"
              ]
            },
            "body": "invalid_payload"
          }
        }

While if I use the same body field from above, parsing it as json, and make a post call using the postman, I get 200 Ok response, and the message is posted to slack channel. Not sure what I am missing.