# Action - Sending Email Alert through Gmail or Outlook

**URL:** <https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533>\
**Category:** Elasticsearch\
**Created:** [October 11, 2017, 10:59am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533 "2017-10-11T10:59:26Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sanju\_Mon](https://avatars.discourse-cdn.com/v4/letter/s/f6c823/32.png) [@Sanju\_Mon](https://discuss.elastic.co/u/Sanju_Mon)\
**Post date:** [October 11, 2017, 10:59am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/1 "2017-10-11T10:59:26Z")

</div>

Hi,  
In my setup, there is an Elasticsearch running which has XS logs being pumped in it through Broadworks. X-Pack is also installed. My requirement is to send and email alert in case of a specific condition. For this purpose , I have added the following in /etc/elasticsearch/elasticsearch.yml

```
xpack.notification.email.account:
    gmail_account:
        profile: gmail
        smtp:
            auth: true
            starttls.enable: true
            host: smtp.gmail.com
            port: 587
            user: <username>
            password: <password>

```

Similarly, I am creating a watcher using curl command as below:

```
curl -u elastic:changeme -XPUT '<ip_address>:9200/_xpack/watcher/watch/log_error_watch?pretty' -H 'Content-Type: application/json' -d'
{
  "trigger" : { "schedule" : { "interval" : "5s" }},
  "input" : {
    "search" : {
      "request" : {
        "indices" : ["bwlog*"],
        "body" : {
          "query" : {
            "match" : { "sipmethod" : "REGISTER" }
          }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 5 }}
  },
  "actions" : {
    "send_email" : {
      "email" : {
	    "to" : "<recipient_address>",
	    "subject" : "Watcher Notification",
            "body" : "Found {{ctx.payload.hits.total}} errors in the logs"
      }
    }
  }
}
'

```

After restarting the elasticsearch with new config, I have created the watcher and logs are also pumped into it. I can view the incoming logs in Kibana.

But I don't know, where the problem is stuck so that the mail alert is not working. For testing purpose, I even provided the access for less secure apps of my gmail account in gmail account settings. Still, the mail is not getting triggered. I tried all possibilities as far as I learnt so far.

Please help me through this to get the email action part done.  
Thanks in advance 🙂

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [October 11, 2017, 7:49pm UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/2 "2017-10-11T19:49:20Z")

</div>

Two simple things to test first:

1. Does your watch really fire when expected? You can add the [logging action](https://www.elastic.co/guide/en/x-pack/current/actions-logging.html) to see the output of the watch is matching what/when you expect.

2. Ensure that the machine executing the watch can communicate with [smtp.gmail.com](http://smtp.gmail.com). Simply validate that you get the following connection response when telneting to port 587:

```auto
%> telnet smtp.gmail.com 587
Trying 173.194.205.108...
Connected to gmail-smtp-msa.l.google.com.
Escape character is '^]'.
220 smtp.gmail.com ESMTP b57sm8719026qtb.3 - gsmtp

```

---

<div class="post-metadata">

**Author:** ![Sanju\_Mon](https://avatars.discourse-cdn.com/v4/letter/s/f6c823/32.png) [@Sanju\_Mon](https://discuss.elastic.co/u/Sanju_Mon)\
**Post date:** [October 17, 2017, 5:31am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/3 "2017-10-17T05:31:57Z")

</div>

Got the telnet part done. Thanks @richcollier 🙂

---

<div class="post-metadata">

**Author:** ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)\
**Post date:** [October 20, 2017, 7:01am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/4 "2017-10-20T07:01:50Z")

</div>

Hi Team

I 've configured a job in x-pack to monitor the real time data, ie: if there is any anomaly found in my data then the system should trigger an email to my box. But the system is failing to send email.

I tried the below

1. Watch created using curl command from command line – This gets triggered and the mails were sent.

2. watch created when the ML job was created from GUI - email is not getting triggered

for this case  
"send\_email" : {  
"ack" : {  
"timestamp" : "2017-10-20T01:07:20.937Z",  
"state" : "awaits\_successful\_execution"  
}  
}

In the above, action state is in awaits\_successful\_execution but I could see some anomalies in the data passed.

I did force execution via curl -XPOST 'x.x.x.x:9200/\_xpack/watcher/watch/ml-test/\_execute?pretty' -H 'Content-Type: application/json' -d'  
{  
"record\_execution" : true  
}  
'

but the status didn't change ☹

any kind of help would be appreciated

Thanks  
Arun

---

<div class="post-metadata">

**Author:** ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)\
**Post date:** [October 23, 2017, 4:47am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/5 "2017-10-23T04:47:20Z")

</div>

any help pl

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 23, 2017, 7:40am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/6 "2017-10-23T07:40:31Z")

</div>

please paste the **full** output of the execute watch API here.

Thanks!

---

<div class="post-metadata">

**Author:** ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)\
**Post date:** [October 23, 2017, 9:00am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/7 "2017-10-23T09:00:40Z")

</div>

{  
"\_id" : "ml-s2\_e6d68302-8d1b-4473-a0dc-aaa82ab06fbd-2017-10-23T08:55:04.407Z",  
"watch\_record" : {  
"watch\_id" : "ml-s2",  
"state" : "execution\_not\_needed",  
"status" : {  
"state" : {  
"active" : false,  
"timestamp" : "2017-10-20T08:56:15.979Z"  
},  
"last\_checked" : "2017-10-23T08:55:04.407Z",  
"actions" : {  
"log" : {  
"ack" : {  
"timestamp" : "2017-10-20T01:07:20.937Z",  
"state" : "awaits\_successful\_execution"  
}  
},  
"send\_email" : {  
"ack" : {  
"timestamp" : "2017-10-20T01:07:20.937Z",  
"state" : "awaits\_successful\_execution"  
}  
}  
}  
},  
"trigger\_event" : {  
"type" : "manual",  
"triggered\_time" : "2017-10-23T08:55:04.407Z",  
"manual" : {  
"schedule" : {  
"scheduled\_time" : "2017-10-23T08:55:04.407Z"  
}  
}  
},  
"input" : {  
"search" : {  
"request" : {  
"search\_type" : "query\_then\_fetch",  
"indices" : [  
".ml-anomalies-\*"  
],  
"types" : [],  
"body" : {  
"size" : 0,  
"query" : {  
"bool" : {  
"filter" : [  
{  
"term" : {  
"job\_id" : "s2"  
}  
},  
{  
"range" : {  
"timestamp" : {  
"gte" : "now-10m"  
}  
}  
},  
{  
"terms" : {  
"result\_type" : [  
"bucket",  
"record",  
"influencer"  
]  
}  
}  
]  
}  
},  
"aggs" : {  
"bucket\_results" : {  
"filter" : {  
"range" : {  
"anomaly\_score" : {  
"gte" : 25  
}  
}  
},  
"aggs" : {  
"top\_bucket\_hits" : {  
"top\_hits" : {  
"sort" : [  
{  
"anomaly\_score" : {  
"order" : "desc"  
}  
}  
],  
"\_source" : {  
"includes" : [  
"job\_id",  
"result\_type",  
"timestamp",  
"anomaly\_score",  
"is\_interim"  
]  
},

---

<div class="post-metadata">

**Author:** ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)\
**Post date:** [October 23, 2017, 9:01am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/8 "2017-10-23T09:01:09Z")

</div>

"size" : 1,  
"script\_fields" : {  
"start" : {  
"script" : {  
"lang" : "painless",  
"inline" : "new Date(doc["timestamp"].date.getMillis()-doc["bucket\_span"].value \* 1000 \* params.padding)",  
"params" : {  
"padding" : 10  
}  
}  
},  
"end" : {  
"script" : {  
"lang" : "painless",  
"inline" : "new Date(doc["timestamp"].date.getMillis()+doc["bucket\_span"].value \* 1000 \* params.padding)",  
"params" : {  
"padding" : 10  
}  
}  
},  
"timestamp\_epoch" : {  
"script" : {  
"lang" : "painless",  
"inline" : "doc["timestamp"].date.getMillis()/1000"  
}  
},  
"timestamp\_iso8601" : {  
"script" : {  
"lang" : "painless",  
"inline" : "doc["timestamp"].date"  
}  
},  
"score" : {  
"script" : {  
"lang" : "painless",  
"inline" : "Math.round(doc["anomaly\_score"].value)"  
}  
}  
}  
}  
}  
}  
},  
"influencer\_results" : {  
"filter" : {  
"range" : {  
"influencer\_score" : {  
"gte" : 3  
}  
}  
},  
"aggs" : {  
"top\_influencer\_hits" : {  
"top\_hits" : {  
"sort" : [  
{  
"influencer\_score" : {  
"order" : "desc"  
}  
}  
],  
"\_source" : {  
"includes" : [  
"result\_type",  
"timestamp",  
"influencer\_field\_name",  
"influencer\_field\_value",  
"influencer\_score",  
"isInterim"  
]  
},  
"size" : 3,  
"script\_fields" : {  
"score" : {  
"script" : {  
"lang" : "painless",  
"inline" : "Math.round(doc["influencer\_score"].value)"  
}  
}  
}  
}  
}  
}  
},  
"record\_results" : {  
"filter" : {  
"range" : {  
"record\_score" : {  
"gte" : 3  
}  
}  
},  
"aggs" : {  
"top\_record\_hits" : {  
"top\_hits" : {  
"sort" : [  
{  
"record\_score" : {  
"order" : "desc"  
}  
}  
],  
"\_source" : {  
"includes" : [  
"result\_type",  
"timestamp",  
"record\_score",  
"is\_interim",  
"function",  
"field\_name",  
"by\_field\_value",  
"over\_field\_value",  
"partition\_field\_value"  
]  
},  
"size" : 3,  
"script\_fields" : {  
"score" : {  
"script" : {  
"lang" : "painless",  
"inline" : "Math.round(doc["record\_score"].value)"  
}  
}  
}  
}  
}  
}  
}  
}  
}  
}  
}  
},

---

<div class="post-metadata">

**Author:** ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)\
**Post date:** [October 23, 2017, 9:02am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/9 "2017-10-23T09:02:18Z")

</div>

"condition" : {  
"compare" : {  
"ctx.payload.aggregations.bucket\_results.doc\_count" : {  
"gt" : 0  
}  
}  
},  
"result" : {  
"execution\_time" : "2017-10-23T08:55:04.407Z",  
"execution\_duration" : 11,  
"input" : {  
"type" : "search",  
"status" : "success",  
"payload" : {  
"\_shards" : {  
"total" : 15,  
"failed" : 0,  
"successful" : 15,  
"skipped" : 0  
},  
"hits" : {  
"hits" : [],  
"total" : 0,  
"max\_score" : 0.0  
},  
"took" : 3,  
"timed\_out" : false,  
"aggregations" : {  
"influencer\_results" : {  
"doc\_count" : 0,  
"top\_influencer\_hits" : {  
"hits" : {  
"hits" : [],  
"total" : 0,  
"max\_score" : null  
}  
}  
},  
"record\_results" : {  
"doc\_count" : 0,  
"top\_record\_hits" : {  
"hits" : {  
"hits" : [],  
"total" : 0,  
"max\_score" : null  
}  
}  
},  
"bucket\_results" : {  
"top\_bucket\_hits" : {  
"hits" : {  
"hits" : [],  
"total" : 0,  
"max\_score" : null  
}  
},  
"doc\_count" : 0  
}  
}  
},  
"search" : {  
"request" : {  
"search\_type" : "query\_then\_fetch",  
"indices" : [  
".ml-anomalies-\*"  
],  
"types" : [],  
"body" : {  
"size" : 0,  
"query" : {  
"bool" : {  
"filter" : [  
{  
"term" : {  
"job\_id" : "s2"  
}  
},  
{  
"range" : {  
"timestamp" : {  
"gte" : "now-10m"  
}  
}  
},  
{  
"terms" : {  
"result\_type" : [  
"bucket",  
"record",  
"influencer"  
]  
}  
}  
]  
}  
},  
"aggs" : {  
"bucket\_results" : {  
"filter" : {  
"range" : {  
"anomaly\_score" : {  
"gte" : 25  
}  
}  
},  
"aggs" : {  
"top\_bucket\_hits" : {  
"top\_hits" : {  
"sort" : [  
{  
"anomaly\_score" : {  
"order" : "desc"  
}  
}  
],  
"\_source" : {  
"includes" : [  
"job\_id",  
"result\_type",  
"timestamp",  
"anomaly\_score",  
"is\_interim"  
]  
},  
"size" : 1,  
"script\_fields" : {  
"start" : {  
"script" : {  
"lang" : "painless",  
"inline" : "new Date(doc["timestamp"].date.getMillis()-doc["bucket\_span"].value \* 1000 \* params.padding)",  
"params" : {  
"padding" : 10  
}  
}  
},  
"end" : {  
"script" : {  
"lang" : "painless",  
"inline" : "new Date(doc["timestamp"].date.getMillis()+doc["bucket\_span"].value \* 1000 \* params.padding)",  
"params" : {  
"padding" : 10  
}  
}  
},  
"timestamp\_epoch" : {  
"script" : {  
"lang" : "painless",  
"inline" : "doc["timestamp"].date.getMillis()/1000"  
}  
},  
"timestamp\_iso8601" : {  
"script" : {  
"lang" : "painless",  
"inline" : "doc["timestamp"].date"  
}  
},  
"score" : {  
"script" : {  
"lang" : "painless",  
"inline" : "Math.round(doc["anomaly\_score"].value)"  
}  
}  
}  
}  
}  
}  
},

---

<div class="post-metadata">

**Author:** ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)\
**Post date:** [October 23, 2017, 9:02am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/10 "2017-10-23T09:02:41Z")

</div>

```
     "influencer_results" : {
              "filter" : {
                "range" : {
                  "influencer_score" : {
                    "gte" : 3
                  }
                }
              },
              "aggs" : {
                "top_influencer_hits" : {
                  "top_hits" : {
                    "sort" : [
                      {
                        "influencer_score" : {
                          "order" : "desc"
                        }
                      }
                    ],
                    "_source" : {
                      "includes" : [
                        "result_type",
                        "timestamp",
                        "influencer_field_name",
                        "influencer_field_value",
                        "influencer_score",
                        "isInterim"
                      ]
                    },
                    "size" : 3,
                    "script_fields" : {
                      "score" : {
                        "script" : {
                          "lang" : "painless",
                          "inline" : "Math.round(doc[\"influencer_score\"].value)"
                        }
                      }
                    }
                  }
                }
              }
            },
            "record_results" : {
              "filter" : {
                "range" : {
                  "record_score" : {
                    "gte" : 3
                  }
                }
              },
              "aggs" : {
                "top_record_hits" : {
                  "top_hits" : {
                    "sort" : [
                      {
                        "record_score" : {
                          "order" : "desc"
                        }
                      }
                    ],
                    "_source" : {
                      "includes" : [
                        "result_type",
                        "timestamp",
                        "record_score",
                        "is_interim",
                        "function",
                        "field_name",
                        "by_field_value",
                        "over_field_value",
                        "partition_field_value"
                      ]
                    },
                    "size" : 3,
                    "script_fields" : {
                      "score" : {
                        "script" : {
                          "lang" : "painless",
                          "inline" : "Math.round(doc[\"record_score\"].value)"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition" : {
    "type" : "compare",
    "status" : "success",
    "met" : false,
    "compare" : {
      "resolved_values" : {
        "ctx.payload.aggregations.bucket_results.doc_count" : 0
      }
    }
  },
  "actions" : []
},
"messages" : []

```

}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 23, 2017, 9:15am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/11 "2017-10-23T09:15:21Z")

</div>

please create a single well formatted gist out of this instead of three separate documents, this is impossible to read and follow for anyone.

See [https://www.elastic.co/help](https://www.elastic.co/help)

---

<div class="post-metadata">

**Author:** ![Arun\_Raj](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@Arun\_Raj](https://discuss.elastic.co/u/Arun_Raj)\
**Post date:** [October 23, 2017, 11:41am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/12 "2017-10-23T11:41:24Z")

</div>

Sorry Alex I m getting an invalid json format even-though the content is proper as per [https://jsonformatter.curiousconcept.com/](https://jsonformatter.curiousconcept.com/)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 20, 2017, 11:41am UTC](https://discuss.elastic.co/t/action-sending-email-alert-through-gmail-or-outlook/103533/13 "2017-11-20T11:41:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.