Bug report X-Pack: Watcher email action uses the same `Message-ID` if multiple mail actions are used

Elasticsearch version (bin/elasticsearch --version): Version: 5.5.1, Build: 19c13d0/2017-07-18T20:44:24.823Z, JVM: 1.8.0_151

Plugins installed: repository-azure, x-pack

JVM version (java -version):

openjdk version "1.8.0_151"
OpenJDK Runtime Environment (IcedTea 3.6.0) (build 1.8.0_151-b12 suse-18.1-x86_64)
OpenJDK 64-Bit Server VM (build 25.151-b12, mixed mode)

OS version (uname -a if on a Unix-like system): openSUSE Leap 42.3, Linux xxxxxxxx 4.4.114-42-default #1 SMP Tue Feb 6 10:58:10 UTC 2018 (b6ee9ae) x86_64 x86_64 x86_64 GNU/Linux

Description of the problem including expected versus actual behavior: Watcher email action uses the same Message-ID if multiple mail actions are used in the same watch. This can cause unexpected behavior for mail servers (MTAs). It is therefore expected to either omit the Message-ID field, or ensure that a unique one is used for every mail action.

Steps to reproduce:

Please include a minimal but complete recreation of the problem, including
(e.g.) index creation, mappings, settings, query etc. The easier you make for
us to reproduce it, the more likely that somebody will take the time to look at it.

  1. Define and put watch with multiple email actions into Elasticsearch. Example:

    ---
    
    ## Only a partial watch definition.
    ## Note that I am using YAML. PS: YAML is awesome.
    
    actions:
      test1:
        email:
          to: 'Robin Schneider <robin.schneider@example.com>'
    
          subject: 'Test 1'
          body: 'test'
    
      test2:
        email:
          to: 'Robin Schneider <robin.schneider@example.com>'
    
          subject: 'Test 2'
          body: 'test'
    
  2. Trace network connection using tcpdump 'port 25' -nn -s 0 -w /tmp/watcher_mail.pcap or Wireshark.

  3. Execute or simulate the watch.

  4. Reassemble the TCP connection.

Provide logs (if relevant):

This is reproducible.

Run 1 (for both mails the same):

Message-ID: _inlined__49e6b804-2e77-4214-8b02-1c0a412caa32-2018-04-16T08:28:32.888Z
Subject: Test 1
MIME-Version: 1.0

Run 2 (for both mails the same):

Message-ID: _inlined__37d6df2a-7eeb-451f-9b64-d54ecffe166f-2018-04-17T14:57:56.172Z
Subject: Test 1
MIME-Version: 1.0

PS: I reported this first on Github (https://github.com/elastic/elasticsearch/issues/29563) but then got redirected to the forum.

Hey Robin

thanks a ton for creating the issue here as well, it may have slipped my eyes otherwise. You are right, that the message id stays the same as we do not use the action id, but only the watch id for the message ID, thus leading to duplicates when sending more than one email per watch execution. I'll create a fix for this one by taking the action id into account as well.

--Alex

1 Like

FYI: https://github.com/elastic/elasticsearch/pull/30112

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.