# Help config plugin output mail **URL:** \ **Category:** Logstash\ **Created:** [July 24, 2015, 5:30pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259 "2015-07-24T17:30:22Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![fabioebner](https://avatars.discourse-cdn.com/v4/letter/f/a3d4f5/32.png) [@fabioebner](https://discuss.elastic.co/u/fabioebner)\ **Post date:** [July 24, 2015, 5:30pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/1 "2015-07-24T17:30:22Z")
I'm trying to configure the logstash to send the ERROR to my email I use this: ``` email { to => "fabioebner@gmail.com" codec => "plain" contenttype => "text/html; charset=UTF-8" options => { smpt => { smtpIporHost => "smtp.gmail.com" port => 465 userName => "user@gmail.com" password => "mypass" starttls => true } } } ``` But i got this error: } Errno::ECONNREFUSED: Connection refused - Connection refused initialize at org/jruby/ext/socket/RubyTCPSocket.java:126 open at org/jruby/RubyIO.java:1179 tcp\_socket at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:541 do\_start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:550 timeout at org/jruby/ext/timeout/Timeout.java:126 do\_start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:550 start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:520 deliver! at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/network/delivery\_methods/smtp.rb:112 deliver! at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/message.rb:252 receive at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-output-email-1.0.0/lib/logstash/outputs/email.rb:250 handle at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/outputs/base.rb:88 output\_func at (eval):27 outputworker at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:243 start\_outputs at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:165 ---
**Author:** ![fabioebner](https://avatars.discourse-cdn.com/v4/letter/f/a3d4f5/32.png) [@fabioebner](https://discuss.elastic.co/u/fabioebner)\ **Post date:** [July 24, 2015, 5:36pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/2 "2015-07-24T17:36:05Z")
i change the config to this: ``` email { to => "fabioebner@gmail.com" codec => "plain" contenttype => "text/html; charset=UTF-8" via => "smtp" options => { smtpIporHost => "smtp.gmail.com" port => 465 userName => "user@gmail.com" password => "mypass" starttls => true } } ``` but now i got this error: Timeout::Error: Timeout::Error rbuf\_fill at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/protocol.rb:146 readuntil at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/protocol.rb:122 readline at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/protocol.rb:132 recv\_response at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:930 do\_start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:553 critical at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:940 do\_start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:553 start at C:/java/logstash-1.5.2/vendor/jruby/lib/ruby/1.9/net/smtp.rb:520 deliver! at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/network/delivery\_methods/smtp.rb:112 deliver! at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/mail-2.6.3/lib/mail/message.rb:252 receive at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-output-email-1.0.0/lib/logstash/outputs/email.rb:250 handle at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/outputs/base.rb:88 output\_func at (eval):27 outputworker at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:243 start\_outputs at C:/java/logstash-1.5.2/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.2.2-java/lib/logstash/pipeline.rb:165 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 24, 2015, 6:59pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/3 "2015-07-24T18:59:34Z")
``` email { to => "fabioebner@gmail.com" codec => "plain" contenttype => "text/html; charset=UTF-8" options => { smpt => { smtpIporHost => "smtp.gmail.com" port => 465 userName => "user@gmail.com" password => "mypass" starttls => true } } } ``` Do you really have "smpt" in your configuration file? Also, I think you're nesting your configuration too much. This should work better: ``` email { to => "fabioebner@gmail.com" codec => "plain" contenttype => "text/html; charset=UTF-8" options => { smtpIporHost => "smtp.gmail.com" port => 465 userName => "user@gmail.com" password => "mypass" starttls => true } } ``` If the `starttls` option as the name suggests selects whether to use STARTTLS or not I suspect you should be using port 587 instead. Port 465 is for SMTPS, i.e. SMTP over SSL. (The documentation of the `options` parameter is really bad BTW. See [https://github.com/logstash-plugins/logstash-output-email/issues/24.)](https://github.com/logstash-plugins/logstash-output-email/issues/24.)) ---
**Author:** ![fabioebner](https://avatars.discourse-cdn.com/v4/letter/f/a3d4f5/32.png) [@fabioebner](https://discuss.elastic.co/u/fabioebner)\ **Post date:** [July 24, 2015, 7:12pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/4 "2015-07-24T19:12:19Z")
magnunsbaeck Tks, works but now the LS send one email from each line in my log and how i put the error message in body of email? tks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 24, 2015, 8:16pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/5 "2015-07-24T20:16:30Z")
> but now the LS send one email from each line in my log Yes, that's expected if you don't wrap your output in a conditional. > and how i put the error message in body of email? Set the `body` parameter and reference the field containing the error message. ``` email { body => "%{field-with-error-message}" ... } ``` ---
**Author:** ![eds](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@eds](https://discuss.elastic.co/u/eds)\ **Post date:** [August 23, 2016, 11:19am UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/6 "2016-08-23T11:19:51Z")
magnunsbaeck, my config works fine, but i need send each event (winlogbeat critical events) at email and in elasticsearch index. Can i configure .conf file to do this (send one event in two places) ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2016, 12:02pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/7 "2016-08-23T12:02:14Z")
Yes, your configuration can contain any number of outputs. ---
**Author:** ![eds](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@eds](https://discuss.elastic.co/u/eds)\ **Post date:** [August 23, 2016, 12:17pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/8 "2016-08-23T12:17:25Z")
then i use: ```auto input { beats { port => 5044 } } output { if [type] == "wineventlog" and [level] == "_Warning" { email { to => "adm@xx.local" address => "192.168.1.5" from => "logstash@xx.loclal" subject => "Wineventlog Warning from: %{computer_name}" body => "%{log_name} event: %{message}" } } else if [type] == "wineventlog" and [level] == "_Error" { email { to => "adm@xx.local" address => "192.168.1.5" from => "logstash@xx.loclal" subject => "Wineventlog Error from: %{computer_name}" body => "%{log_name} event: %{message}" } } else{ elasticsearch { hosts => "localhost:9200" index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document_type => "%{[@metadata][type]}" } } } ``` i received filtered events by email, but loose it in index ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [August 23, 2016, 12:19pm UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/9 "2016-08-23T12:19:33Z")
That's expected with your configuration. Events that reach either of the email output will never reach the ES output. Don't use an `else` block here. ---
**Author:** ![eds](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@eds](https://discuss.elastic.co/u/eds)\ **Post date:** [August 24, 2016, 6:11am UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/10 "2016-08-24T06:11:03Z")
Magnus, thanks for help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:41am UTC](https://discuss.elastic.co/t/help-config-plugin-output-mail/26259/11 "2017-07-06T04:41:57Z")