# eMail Notification via Logstash

**URL:** <https://discuss.elastic.co/t/email-notification-via-logstash/103218>\
**Category:** Logstash\
**Created:** [October 9, 2017, 11:05am UTC](https://discuss.elastic.co/t/email-notification-via-logstash/103218 "2017-10-09T11:05:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![baldy2811](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baldy2811/32/12744_2.png) [@baldy2811](https://discuss.elastic.co/u/baldy2811)\
**Post date:** [October 9, 2017, 11:05am UTC](https://discuss.elastic.co/t/email-notification-via-logstash/103218/1 "2017-10-09T11:05:12Z")

</div>

Hi there,

i wanted to have email Notifications when some issues appears.  
I created such Output:

output {  
elasticsearch {  
hosts =\> ["10.10.5.100:9200"]  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
document\_type =\> "%{[@metadata][type]}"  
}  
if "CRITICAL" in [log\_type] or "500" in [nginx.access.response\_code] or "404" in [nginx.access.response\_code] {  
email {  
from =\> "logging@localhost"  
to =\> "daniel@linux-nerd.de"  
subject =\> "Logstash found an error"  
body =\> "ERROR: For more details take a look into Kibana. The message from logstash input: %{message}"  
}  
}  
}

Logstash will shift all data to Elasticsearch but did not send any eMails which these rules.

Could someone tell me where my mistake is?

Cheers

Daniel

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 9, 2017, 7:06pm UTC](https://discuss.elastic.co/t/email-notification-via-logstash/103218/2 "2017-10-09T19:06:08Z")

</div>

This is an extremely bad idea that could flood your mailbox with thousands or even millions of messages. Look into using e.g. Elastalert or Elastic's own Watcher instead.

That said, the reason things aren't working is probably that you're not referencing nested fields correctly. See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2017, 7:06pm UTC](https://discuss.elastic.co/t/email-notification-via-logstash/103218/3 "2017-11-06T19:06:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.