# Email notification with source details

**URL:** https://discuss.elastic.co/t/email-notification-with-source-details/129982
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [April 30, 2018, 6:03am UTC](https://discuss.elastic.co/t/email-notification-with-source-details/129982 "2018-04-30T06:03:48Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![nikbhadane](https://avatars.discourse-cdn.com/v4/letter/n/ecb155/32.png) [@nikbhadane](https://discuss.elastic.co/u/nikbhadane)
#### Post date: [April 30, 2018, 6:03am UTC](https://discuss.elastic.co/t/email-notification-with-source-details/129982/1 "2018-04-30T06:03:48Z")

</div>

Hello,

I am currently using

Kibana version: 4.5.4  
Elasticsearch version: 2.X  
logstash Version : 2.2

I have also added watcher plugin to get email notifications.

Everything is working fine.

I need to do some extra modification with watcher plugin.

I want emails with error log data, not just the title but with the full error log description.

Can you please help me?

---

<div class="post-metadata">

### Author: ![nikbhadane](https://avatars.discourse-cdn.com/v4/letter/n/ecb155/32.png) [@nikbhadane](https://discuss.elastic.co/u/nikbhadane)
#### Post date: [May 2, 2018, 4:25am UTC](https://discuss.elastic.co/t/email-notification-with-source-details/129982/2 "2018-05-02T04:25:00Z")

</div>

Kindly please help?

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 2, 2018, 7:43am UTC](https://discuss.elastic.co/t/email-notification-with-source-details/129982/3 "2018-05-02T07:43:13Z")

</div>

Please note that his forum does not come with an SLA bound to it. If you need support within a certain time, then please check out our [subscriptions](https://www.elastic.co/subscriptions).

That said, can you please elaborate a bit more? Is this a question of how to create a watch or do you need help adapting an existing one? Far more information is needed to properly help.

Also note, that the elasticsearch version you are using is no longer in development and not even in maintenance mode. If you want to get bugfixes along with more features, you should switch to Elasticsearch 6.x.

---

<div class="post-metadata">

### Author: ![nikbhadane](https://avatars.discourse-cdn.com/v4/letter/n/ecb155/32.png) [@nikbhadane](https://discuss.elastic.co/u/nikbhadane)
#### Post date: [May 2, 2018, 8:48am UTC](https://discuss.elastic.co/t/email-notification-with-source-details/129982/4 "2018-05-02T08:48:26Z")

</div>

Thank you so much for your time and response.

I need help adapting the existing one.

I have already set the watcher, Now i am looking for the total message(log message) as a body to send email.

The watcher currently i set is as follows:

curl -XPUT 'localhost:9200/\_watcher/watch/auths\_alert?pretty' -H 'Content-Type: application/json' -d'  
{  
"trigger" : {  
"schedule" : {  
"interval" : "5m"  
}  
},  
"input" : {  
"search" : {  
"request" : {  
"indices" : "filebeat-2018.04.17",  
"body" : {  
"size" : 0,  
"query" : { "match" : { "message" : "authentication" } }  
}  
}  
}  
},  
"condition" : {  
"compare" : {  
"ctx.payload.hits.total" : {  
"gt" : 3  
}  
}   
},  
"actions" : {  
"email\_administrator" : {  
"throttle\_period": "15m",  
"email" : {  
"to" : "testemail@hotmail.com",  
"subject" : "Encountered {{ctx.payload.hits.total}} errors",  
"body" : "Too many Unknown error in the system, see attached data",  
"priority" : "high"  
}  
}  
}  
}  
'

It is working fine but i want it to elaborate more, So when i receive mail i also want total logs for that error in mail body.

In short in body of mail, we can view whole message.

Please help?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 30, 2018, 8:48am UTC](https://discuss.elastic.co/t/email-notification-with-source-details/129982/5 "2018-05-30T08:48:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
