# GET log from access\_log's apache to send email

**URL:** <https://discuss.elastic.co/t/get-log-from-access-logs-apache-to-send-email/109325>\
**Category:** Elasticsearch\
**Created:** [November 28, 2017, 7:47am UTC](https://discuss.elastic.co/t/get-log-from-access-logs-apache-to-send-email/109325 "2017-11-28T07:47:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tran\_canh\_khanh](https://avatars.discourse-cdn.com/v4/letter/t/eb8c5e/32.png) [@tran\_canh\_khanh](https://discuss.elastic.co/u/tran_canh_khanh)\
**Post date:** [November 28, 2017, 7:47am UTC](https://discuss.elastic.co/t/get-log-from-access-logs-apache-to-send-email/109325/1 "2017-11-28T07:47:16Z")

</div>

Hi guys.  
I'm using x-pack to alert when my website is attacked with access file "/etc/password". I created 1 watcher with bellow content

> {  
> "trigger": {  
> "schedule": {  
> "interval": "5m"  
> }  
> },  
> "input": {  
> "search": {  
> "request": {  
> "search\_type": "query\_then\_fetch",  
> "indices": [  
> "logstash-\*"  
> ],  
> "types": ,  
> "body": {  
> "size": 0,  
> "query": {  
> "bool": {  
> "should": [  
> {  
> "match": {  
> "request": "/etc/passwd"  
> }  
> },  
> {  
> "match": {  
> "request": "/config"  
> }  
> }  
> ],  
> "filter": {  
> "range": {  
> "@timestamp": {  
> "from": "now-5m",  
> "to": "now"  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> }  
> },  
> "condition": {  
> "compare": {  
> "ctx.payload.hits.total": {  
> "gt": 0  
> }  
> }  
> },  
> "actions": {  
> "send\_email": {  
> "email": {  
> "profile": "standard",  
> "from": "[xxx@gmail.com](mailto:xxx@gmail.com)",  
> "to": [  
> "[yyy@gmail.com](mailto:yyy@gmail.com)"  
> ],  
> "subject": "Watcher Notification",  
> "body": {  
> "text": "WARNING: {{ctx.payload.hits.total}} access /etc/passwd"  
> }  
> }  
> }  
> }  
> }

I want to get IP address which accessed. but i can't get it. Please help me get information IP address and send it email in watcher.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 28, 2017, 7:56am UTC](https://discuss.elastic.co/t/get-log-from-access-logs-apache-to-send-email/109325/2 "2017-11-28T07:56:36Z")

</div>

You can access the hits in the `ctx.payload.hits.hits` array data structure and access the IP addresses. However, this data is a regular search and only contains the first 10 hits. You actually need an aggregation to the ip address field, and then use that output in your email.

So two steps to do:

1. Change your search to have a terms aggregation on the IP address field.
2. Change your text to loop through that aggregation using mustache template and return the bucket keys.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2017, 7:56am UTC](https://discuss.elastic.co/t/get-log-from-access-logs-apache-to-send-email/109325/3 "2017-12-26T07:56:46Z")

</div>

Closed on December 26, 2017, 7:56am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.