# Email alerting

**URL:** <https://discuss.elastic.co/t/email-alerting/121168>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 23, 2018, 5:30am UTC](https://discuss.elastic.co/t/email-alerting/121168 "2018-02-23T05:30:25Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)\
**Post date:** [February 23, 2018, 5:30am UTC](https://discuss.elastic.co/t/email-alerting/121168/1 "2018-02-23T05:30:26Z")

</div>

I was trying to set the email alerting according to the official doc.  
The configuration for email has been set up successfully.  
Here is my code segment.

```
POST _xpack/watcher/watches/email_test
{
  "trigger" : {
    "schedule" : {
      "interval" : "1m"
    }
  },
  "actions" : {
    "email_admin" : {
      "email" : {
        "to" : "username@mail.com",
        "subject" : "Error Monitoring Report",
        "priority" : "high"
      }
    }
  }
}

```

But it shows,  
`No handler found for uri [/_xpack/watcher/watches/email_test] and method [POST]`

My version is 6.2.1

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 23, 2018, 8:53am UTC](https://discuss.elastic.co/t/email-alerting/121168/2 "2018-02-23T08:53:25Z")

</div>

Have you installed the `x-pack` plugin on all nodes of your cluster?

---

<div class="post-metadata">

**Author:** ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)\
**Post date:** [February 23, 2018, 5:53pm UTC](https://discuss.elastic.co/t/email-alerting/121168/3 "2018-02-23T17:53:44Z")

</div>

I think so, cuz the slack alerting works.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 23, 2018, 11:20pm UTC](https://discuss.elastic.co/t/email-alerting/121168/4 "2018-02-23T23:20:17Z")

</div>

misread your first line, you need to use `PUT _xpack/watcher/watch/email_test` (not the plural)

---

<div class="post-metadata">

**Author:** ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)\
**Post date:** [February 23, 2018, 11:32pm UTC](https://discuss.elastic.co/t/email-alerting/121168/5 "2018-02-23T23:32:18Z")

</div>

Thank you so much, I got that working.

One more question, if I want to customize the "from" name of the alerting, am I supposed to do like this?

```
PUT _xpack/watcher/watch/email_test
{
  "trigger" : {
    "schedule" : {
      "interval" : "1m"
    }
  },
  "actions" : {
    "email_admin" : {
      "email" : {
        "from" : "Symantec Alerting"
        "to" : "username@mail.com",
        "subject" : "Error Monitoring Report",
        "priority" : "high"
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)\
**Post date:** [February 23, 2018, 11:44pm UTC](https://discuss.elastic.co/t/email-alerting/121168/6 "2018-02-23T23:44:29Z")

</div>

I was trying to delete my previous watch and set a new one called countAuth

```
PUT _xpack/watcher/watch/countAuth
{
  "trigger" : {
    "schedule" : {
      "interval" : "1m"
    }
  },
  "actions" : {
    "email_admin" : {
      "email" : {
        "from" : "Symantec Alerting"
        "to" : "echowu720@gmail.com",
        "subject" : "Error Monitoring Report",
        "priority" : "high"
      }
    }
  }
}

```

But the response shows

```
{
  "error": {
    "root_cause": [
      {
        "type": "i_o_exception",
        "reason": "could not parse watch [countAuth]"
      }
    ],
    "type": "i_o_exception",
    "reason": "could not parse watch [countAuth]",
    "caused_by": {
      "type": "json_parse_exception",
      "reason": "Unexpected character ('\"' (code 34)): was expecting comma to separate Object entries\n at [Source: org.elasticsearch.transport.netty4.ByteBufStreamInput@1636a0f4; line: 11, column: 10]"
    }
  },
  "status": 500
}
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 24, 2018, 9:33am UTC](https://discuss.elastic.co/t/email-alerting/121168/7 "2018-02-24T09:33:53Z")

</div>

missing comma at the end of `from`

---

<div class="post-metadata">

**Author:** ![Pororo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pororo/32/27711_2.png) [@Pororo](https://discuss.elastic.co/u/Pororo)\
**Post date:** [February 25, 2018, 6:42pm UTC](https://discuss.elastic.co/t/email-alerting/121168/8 "2018-02-25T18:42:21Z")

</div>

Hi,

I was trying to customize the "from" name by below,

```
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "none": {}
  },
  "condition": {
    "always": {}
  },
  "actions": {
    "email_admin": {
      "email": {
        "profile": "standard",
        "from": "Symantec Alerting",
        "priority": "high",
        "to": [
          "echowu720@gmail.com"
        ],
        "subject": "Error Monitoring Report"
      }
    }
  }
}

```

But it seems the "from" field could only be a valid email address, not the customized name for displaying in email notification.

If I put "Symantec Alerting" there, it will throw the error that "Local address contains control or whitespace".

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 27, 2018, 12:47pm UTC](https://discuss.elastic.co/t/email-alerting/121168/9 "2018-02-27T12:47:49Z")

</div>

You can use something like `Firstname Lastname <firstname.lastname@example.org>`, see [https://www.elastic.co/guide/en/x-pack/6.2/actions-email.html#email-address](https://www.elastic.co/guide/en/x-pack/6.2/actions-email.html#email-address)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2018, 12:48pm UTC](https://discuss.elastic.co/t/email-alerting/121168/10 "2018-03-27T12:48:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.