# Elasticsearch Alert Email not working - Watcher **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [May 6, 2020, 5:55pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386 "2020-05-06T17:55:38Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [May 6, 2020, 5:55pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/1 "2020-05-06T17:55:38Z")
Dear all, I configured SMTP following the guide [https://www.elastic.co/guide/en/elasticsearch/reference/7.6/actions-email.html#configuring-email](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/actions-email.html#configuring-email) My configuration is as follows: xpack.notification.email.account: gmail\_account: profile: gmail smtp: auth: true starttls.enable: true host: [smtp.gmail.com](http://smtp.gmail.com) port: 587 user: [myemail@gmail.com](mailto:myemail@gmail.com) Then i run the command bin/elasticsearch-keystore add xpack.notification.email.account.gmail\_account.smtp.secure\_password I got an error when I tryed to send a test email, which I will show in next message. I tryed it with a outlook account and with gmail account. Also I allowed less secured apps in Gmail. I see one error of bad username, I don´t know why because usermail is right, and when i run the command I introduced the right password. Any idea? Thank you very much ---
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [May 6, 2020, 5:55pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/2 "2020-05-06T17:55:48Z")
``` [2020-05-06T19:49:20,808][ERROR][o.e.x.w.a.e.ExecutableEmailAction] [localhost.l ocaldomain] failed to execute action [_inlined_/email_1] javax.mail.MessagingException: failed to send email with subject [Watch [Alerta uso de CPU elevado] has exceeded the threshold] via account [gmail_account] at org.elasticsearch.xpack.watcher.notification.email.EmailService.send( EmailService.java:171) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.EmailService.send( EmailService.java:163) ~[?:?] at org.elasticsearch.xpack.watcher.actions.email.ExecutableEmailAction.e xecute(ExecutableEmailAction.java:76) ~[?:?] at org.elasticsearch.xpack.core.watcher.actions.ActionWrapper.execute(Ac tionWrapper.java:164) [x-pack-core-7.6.0.jar:7.6.0] at org.elasticsearch.xpack.watcher.execution.ExecutionService.executeInn er(ExecutionService.java:534) [x-pack-watcher-7.6.0.jar:7.6.0] at org.elasticsearch.xpack.watcher.execution.ExecutionService.execute(Ex ecutionService.java:320) [x-pack-watcher-7.6.0.jar:7.6.0] at org.elasticsearch.xpack.watcher.transport.actions.execute.TransportEx ecuteWatchAction$1.doRun(TransportExecuteWatchAction.java:159) [x-pack-watcher-7 .6.0.jar:7.6.0] at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(Abstrac tRunnable.java:37) [elasticsearch-7.6.0.jar:7.6.0] at org.elasticsearch.xpack.watcher.execution.ExecutionService$WatchExecu tionTask.run(ExecutionService.java:627) [x-pack-watcher-7.6.0.jar:7.6.0] at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreserv ingRunnable.run(ThreadContext.java:633) [elasticsearch-7.6.0.jar:7.6.0] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor. java:1128) [?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor .java:628) [?:?] at java.lang.Thread.run(Thread.java:830) [?:?] Caused by: javax.mail.AuthenticationFailedException: 535-5.7.8 Username and Pass word not accepted. Learn more at 535 5.7.8 https://support.google.com/mail/?p=BadCredentials g6sm3915193wrw.34 - gsmtp at com.sun.mail.smtp.SMTPTransport$Authenticator.authenticate(SMTPTransp ort.java:947) ~[?:?] at com.sun.mail.smtp.SMTPTransport.authenticate(SMTPTransport.java:858) ~[?:?] at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:76 2) ~[?:?] at javax.mail.Service.connect(Service.java:342) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.Account.lambda$exe cuteConnect$2(Account.java:161) ~[?:?] at java.security.AccessController.doPrivileged(AccessController.java:554 ) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.Account.executeCon nect(Account.java:160) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.Account.send(Accou nt.java:119) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.EmailService.send( EmailService.java:169) ~[?:?] ... 12 more [root@localhost elasticsearch]# ``` ---
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [May 6, 2020, 10:27pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/3 "2020-05-06T22:27:22Z")
It´s going crazy... If I swap the configuration between outlook and gmail, it always throw an error regarding Gmail even if Im using outlook in the configuration... I don´t know how to solve this problem. Is there any way to just use a "non-official" email? just something like [no-reply@watcher.com](mailto:no-reply@watcher.com) or [alerts@watcher.com](mailto:alerts@watcher.com) , being generated automatically by Elastic. I tryed Wazuh a long time ago and it could do it, without need to introduce your SMTP configuration. ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 6, 2020, 11:34pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/4 "2020-05-06T23:34:34Z")
Hello @david-vazquez Sorry to ask but: 1. Did you create a dedicated password for your Gmail account at [this link](https://myaccount.google.com/apppasswords)? You cannot use the normal Gmail credentials, especially if you are using 2FA. 2. If you have multiple Elasticsearch nodes, did add the command `bin/elasticsearch-keystore add xpack.notification.email.account.gmail_account.smtp.secure_password` on all nodes? ---
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [May 7, 2020, 11:23am UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/5 "2020-05-07T11:23:54Z")
Hello @Luca_Belluccini, 1. Im not using 2FA. Also didn´t create Gmail dedicated password. I will try it. Anyway, I tryed with gmail just because it was not working with Outlook. I dont care what u se, just would like to work 😃 2. I have a single node with Elasticsearch, so this is not the problem. The thing is If I want to configure it again with outlook, Gmail error is always showed. Configuration is not working for some reason, I dont know whats happening now. Thanks ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 7, 2020, 11:34am UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/6 "2020-05-07T11:34:22Z")
We need to check the settings as the updates are not taken into account. ---
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [May 7, 2020, 2:53pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/7 "2020-05-07T14:53:58Z")
Hello Luca, I followed setting as I said in first message. I mean, just copied and paste the configuration thats showed in the guide, changuind the value of the user account. What exactly do you need to check? Thank you ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 7, 2020, 6:07pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/8 "2020-05-07T18:07:25Z")
Hello @david-vazquez, I'm trying to help. > [@david-vazquez](#): > > It´s going crazy... If I swap the configuration between outlook and gmail, it always throw an error regarding Gmail even if Im using outlook in the configuration... > > I don´t know how to solve this problem. > > Is there any way to just use a "non-official" email? just something like [no-reply@watcher.com](mailto:no-reply@watcher.com) or [alerts@watcher.com](mailto:alerts@watcher.com) , being generated automatically by Elastic. There is for sure a misconfiguration. > [@david-vazquez](#): > > Is there any way to just use a "non-official" email? just something like [no-reply@watcher.com](mailto:no-reply@watcher.com) or [alerts@watcher.com](mailto:alerts@watcher.com) , being generated automatically by Elastic. I tryed Wazuh a long time ago and it could do it, without need to introduce your SMTP configuration. What do you mean? The SMTP server "can" allow a non-existing email, but not all SMTP servers allow that. * * * 1. If you're copy-pasting the configuration, ensure to keep the formatting of the `yaml` file or it can happen that some of the configurations you've done are not taken into account. 2. Try to send the following request and share the response 3. If you're configuring multiple email accounts, on the watcher you need to specify the profile/account to be used, or the default one will be used. For the sake of avoiding errors, share at least the `action` section of your Watch. * * * I have literally your same configuration on a test cluster and I can correctly send the emails via GMail. ---
**Author:** ![david-vazquez](https://avatars.discourse-cdn.com/v4/letter/d/ac8455/32.png) [@david-vazquez](https://discuss.elastic.co/u/david-vazquez)\ **Post date:** [May 7, 2020, 6:38pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/9 "2020-05-07T18:38:13Z")
I know you are trying to help, thank you very much. Finally it´s working... to be honest, I don´t know what I do different from yesterday. Maybe it was problem about format. I´m using Gmail, exactly the same than yesterday, and today is working 😃 We can say sometimes it´s just magic. Anyway, thank you very much for helping me. ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 7, 2020, 6:43pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/10 "2020-05-07T18:43:00Z")
No problem I'm glad it's working now! ---
**Author:** ![Jalpesh1](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@Jalpesh1](https://discuss.elastic.co/u/Jalpesh1)\ **Post date:** [May 25, 2020, 2:17pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/11 "2020-05-25T14:17:57Z")
Hi Team, I am facing same issue. Please find below output for my system. GET \_cluster/settings?flat\_settings&include\_defaults { "persistent" : { }, "transient" : { }, "defaults" : { "action.auto\_create\_index" : "true", "action.destructive\_requires\_name" : "false", "action.search.shard\_count.limit" : "9223372036854775807", "xpack.monitoring.collection.interval" : "10s", "xpack.monitoring.collection.ml.job.stats.timeout" : "10s", "xpack.monitoring.collection.node.stats.timeout" : "10s", "xpack.monitoring.elasticsearch.collection.enabled" : "true", "xpack.monitoring.enabled" : "true", "xpack.monitoring.history.duration" : "168h", "xpack.notification.email.account.gmail\_account.profile" : "gmail", "xpack.notification.email.account.gmail\_account.smtp.auth" : "true", "xpack.notification.email.account.gmail\_account.smtp.host" : "[smtp.gmail.com](http://smtp.gmail.com)", "xpack.notification.email.account.gmail\_account.smtp.port" : "587", "xpack.notification.email.account.gmail\_account.smtp.starttls.enable" : "true", "xpack.notification.email.account.gmail\_account.smtp.user" : "[qktestalert@gmail.com](mailto:qktestalert@gmail.com)", "xpack.notification.email.default\_account" : "", "xpack.notification.email.html.sanitization.allow" : [ "body", "head", "\_tables", "\_links", "\_blocks", "\_formatting", "img:embedded" ], "xpack.notification.email.html.sanitization.disallow" : , "xpack.notification.email.html.sanitization.enabled" : "true", "xpack.notification.jira.default\_account" : "", "xpack.notification.pagerduty.default\_account" : "", "xpack.notification.reporting.interval" : "15s", "xpack.notification.reporting.retries" : "40", "xpack.notification.reporting.warning.enabled" : "true", "xpack.notification.slack.default\_account" : "", "xpack.rollup.enabled" : "true", "xpack.rollup.task\_thread\_pool.queue\_size" : "4", "xpack.rollup.task\_thread\_pool.size" : "4", "xpack.security.audit.enabled" : "false", "xpack.security.audit.logfile.emit\_node\_host\_address" : "false", "xpack.security.audit.logfile.emit\_node\_host\_name" : "false", "xpack.security.audit.logfile.emit\_node\_id" : "true", "xpack.security.audit.logfile.emit\_node\_name" : "false", "xpack.security.audit.logfile.events.emit\_request\_body" : "false", "xpack.security.audit.logfile.events.exclude" : , "xpack.security.audit.logfile.events.include" : [ "ACCESS\_DENIED", "ACCESS\_GRANTED", "ANONYMOUS\_ACCESS\_DENIED", "AUTHENTICATION\_FAILED", "CONNECTION\_DENIED", "TAMPERED\_REQUEST", "RUN\_AS\_DENIED", "RUN\_AS\_GRANTED" ], "xpack.security.authc.anonymous.authz\_exception" : "true", "xpack.watcher.actions.bulk.default\_timeout" : "", "xpack.watcher.actions.index.default\_timeout" : "", "xpack.watcher.bulk.actions" : "1", "xpack.watcher.bulk.concurrent\_requests" : "0", "xpack.watcher.bulk.flush\_interval" : "1s", "xpack.watcher.bulk.size" : "1mb", "xpack.watcher.enabled" : "true", "xpack.watcher.encrypt\_sensitive\_data" : "false", "xpack.watcher.execution.default\_throttle\_period" : "5s", "xpack.watcher.execution.scroll.size" : "0", "xpack.watcher.execution.scroll.timeout" : "", "xpack.watcher.history.cleaner\_service.enabled" : "true", "xpack.watcher.index.rest.direct\_access" : "", "xpack.watcher.input.search.default\_timeout" : "", "xpack.watcher.internal.ops.bulk.default\_timeout" : "", "xpack.watcher.internal.ops.index.default\_timeout" : "", "xpack.watcher.internal.ops.search.default\_timeout" : "", "xpack.watcher.stop.timeout" : "30s", "xpack.watcher.thread\_pool.queue\_size" : "1000", "xpack.watcher.thread\_pool.size" : "20", "xpack.watcher.transform.search.default\_timeout" : "", "xpack.watcher.trigger.schedule.ticker.tick\_interval" : "500ms", "xpack.watcher.watch.scroll.size" : "0" } } Also find below logs: [2020-05-25T19:19:56,581][WARN][o.e.x.w.e.ExecutionService] [JALPESH] failed to execute watch [9b8f79c8-11c1-427d-97bf-ea8f7bd184f9] [2020-05-25T19:20:56,641][WARN][o.e.x.w.e.ExecutionService] [JALPESH] failed to execute watch [9b8f79c8-11c1-427d-97bf-ea8f7bd184f9] [2020-05-25T19:24:59,153][ERROR][o.e.x.w.a.e.ExecutableEmailAction] [JALPESH] failed to execute action [9b8f79c8-11c1-427d-97bf-ea8f7bd184f9/email\_1] javax.mail.MessagingException: failed to send email with subject [Watch [test4] has exceeded the threshold] via account [gmail\_account] at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:171) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:163) ~[?:?] at org.elasticsearch.xpack.watcher.actions.email.ExecutableEmailAction.execute(ExecutableEmailAction.java:76) ~[?:?] at org.elasticsearch.xpack.core.watcher.actions.ActionWrapper.execute(ActionWrapper.java:164) [x-pack-core-7.6.2.jar:7.6.2] at org.elasticsearch.xpack.watcher.execution.ExecutionService.executeInner(ExecutionService.java:534) [x-pack-watcher-7.6.2.jar:7.6.2] at org.elasticsearch.xpack.watcher.execution.ExecutionService.execute(ExecutionService.java:320) [x-pack-watcher-7.6.2.jar:7.6.2] at org.elasticsearch.xpack.watcher.execution.ExecutionService.lambda$executeAsync$5(ExecutionService.java:421) [x-pack-watcher-7.6.2.jar:7.6.2] at org.elasticsearch.xpack.watcher.execution.ExecutionService$$Lambda$4674/1721056180.run(Unknown Source) [x-pack-watcher-7.6.2.jar:7.6.2] at org.elasticsearch.xpack.watcher.execution.ExecutionService$WatchExecutionTask.run(ExecutionService.java:627) [x-pack-watcher-7.6.2.jar:7.6.2] at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:633) [elasticsearch-7.6.2.jar:7.6.2] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0\_40] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0\_40] at java.lang.Thread.run(Thread.java:745) [?:1.8.0\_40] Caused by: javax.mail.AuthenticationFailedException: 535-5.7.8 Username and Password not accepted. Learn more at 535 5.7.8 [https://support.google.com/mail/?p=BadCredentials](https://support.google.com/mail/?p=BadCredentials) v17sm13696968pfc.190 - gsmtp ``` at com.sun.mail.smtp.SMTPTransport$Authenticator.authenticate(SMTPTransport.java:947) ~[?:?] at com.sun.mail.smtp.SMTPTransport.authenticate(SMTPTransport.java:858) ~[?:?] at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:762) ~[?:?] at javax.mail.Service.connect(Service.java:342) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.Account.lambda$executeConnect$2(Account.java:161) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.Account$$Lambda$4974/246305874.run(Unknown Source) ~[?:?] at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_40] at org.elasticsearch.xpack.watcher.notification.email.Account.executeConnect(Account.java:160) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.Account.send(Account.java:119) ~[?:?] at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:169) ~[?:?] ... 12 more ``` ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 25, 2020, 5:12pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/12 "2020-05-25T17:12:31Z")
The error states the credentials are wrong. Same suggestions done before on: > [@Elasticsearch Alert Email not working - Watcher](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/4): > > Hello @david-vazquez Sorry to ask but: Did you create a dedicated password for your Gmail account at [this link](https://myaccount.google.com/apppasswords)? You cannot use the normal Gmail credentials, especially if you are using 2FA. If you have multiple Elasticsearch nodes, did add the command bin/elasticsearch-keystore add xpack.notification.email.account.gmail\_account.smtp.secure\_password on all nodes? And ensure in the watch you specify the account `gmail_account`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 22, 2020, 5:14pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-email-not-working-watcher/231386/13 "2020-06-22T17:14:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.