# Get email notifications on new entries
**URL:** https://discuss.elastic.co/t/get-email-notifications-on-new-entries/250672
**Category:** Kibana
**Created:** [October 1, 2020, 12:31pm UTC](https://discuss.elastic.co/t/get-email-notifications-on-new-entries/250672 "2020-10-01T12:31:01Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@headtea](https://discuss.elastic.co/u/headtea)
#### Post date: [October 1, 2020, 12:31pm UTC](https://discuss.elastic.co/t/get-email-notifications-on-new-entries/250672/1 "2020-10-01T12:31:01Z")
I have set up a honeypot in one of our segments. When someone logs into it, it logs the credentials into a log file. Using filebeat, I ship the new entries from the log to the elastic stack [which looks like that on the dashboard](https://i.imgur.com/vxNsiEb.png).
Since I was given a 0 budget, is there a way to have the elastic stack send an email when that dashboard gets a new entry within the free tier? If not, is there a way to have the Linux OS send a notification when the log file gets a new entry with something like Postfix or Sendmail?
Huge thanks ahead.
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [October 5, 2020, 5:11pm UTC](https://discuss.elastic.co/t/get-email-notifications-on-new-entries/250672/2 "2020-10-05T17:11:37Z")
There is no way of doing it directly from Elasticsearch from the free tier. But I feel your pain with the 0 budget and I will suggest this:
1. Use something like Python to send the emails: [https://realpython.com/python-send-email/](https://realpython.com/python-send-email/)
2. Setup a script to run in the background that queries Elasticsearch (there is a ES Python client that is easy to use) and sends an email when the number of documents in your filebeat indices has increased from the last query.
---
### Author:  [@headtea](https://discuss.elastic.co/u/headtea)
#### Post date: [October 6, 2020, 1:07pm UTC](https://discuss.elastic.co/t/get-email-notifications-on-new-entries/250672/3 "2020-10-06T13:07:20Z")
Thanks for the response!
I've ended up adding the following to my logstash config:
```
# If our honeypot (called cowrie) gets someone, send me an email
if [log][file][path] =~ "cowrie.json" {
if [message] =~ "^New connection" {
email {
from => 'honeypot-entries@companyname-elk.net'
to => 'john@companyname.net'
subject => 'Honeypot Alert'
body => "Someone interacted with the honeypot!\nDetails: %{message}\nClick here to view the dashboard."
domain => 'mail.company.net'
port => 25
}
}
}
```
It works perfectly, now my only problem is settings up the body of the email. I can't seem to create hyperlinks [like this](https://www.google.com). I was suggested to use `htmlbody` instead of `html` but I wasn't able to find how to set a new line since variables are defined in one line.
Basically, all I'm trying to achieve is an email that would look like this:
```
New honeypot entry!
*details*
for successful and failed logins dashboard, click here <- clickable
for command history logins, click here <- clickable
for "suspicious activity" dashboard, click here <- clickable
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 3, 2020, 1:07pm UTC](https://discuss.elastic.co/t/get-email-notifications-on-new-entries/250672/4 "2020-11-03T13:07:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.