# How to create an alerting using the ELK stack(email alerting only)
**URL:** https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662
**Category:** Logstash
**Created:** [April 28, 2016, 10:05am UTC](https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662 "2016-04-28T10:05:42Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@ashutosh25apr](https://discuss.elastic.co/u/ashutosh25apr)
#### Post date: [April 28, 2016, 10:05am UTC](https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662/1 "2016-04-28T10:05:42Z")
Please provide me with steps to add email alerting in ELK . Alerting with Logstash.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 28, 2016, 7:40pm UTC](https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662/2 "2016-04-28T19:40:41Z")
This question is too open to be answered in a meaningful way. I will say though that Logstash isn't very good for alerting. You might find Elastic's Watcher product useful, or maybe you should look into a real monitoring product like Nagios or Icinga.
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 1, 2016, 3:19pm UTC](https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662/3 "2016-05-01T15:19:14Z")
As output, you can use "email" output plugin. I presume you already guess that.
In filter part, you add tag "email" to events that are relevant for an email.
And in output part :
output {
if "email" in [tags] {
email {
...
}
}
}
That said, in filter part, all depends what you exactly want to do...
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 1, 2016, 3:23pm UTC](https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662/4 "2016-05-01T15:23:35Z")
Another way to do what Elastic Watcher do, but in open source :
[https://elastalert.readthedocs.io](https://elastalert.readthedocs.io)
---
### Author:  [@ashutosh25apr](https://discuss.elastic.co/u/ashutosh25apr)
#### Post date: [May 1, 2016, 5:46pm UTC](https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662/5 "2016-05-01T17:46:41Z")
Thanks trying to use elastalert
---
### Author:  [@fbaligand](https://discuss.elastic.co/u/fbaligand)
#### Post date: [May 1, 2016, 6:22pm UTC](https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662/6 "2016-05-01T18:22:13Z")
And to be complete, throttle logstash filter is really nice to detect problems to generate alerts.
For example : more than 30 errors in 1 minute.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:59am UTC](https://discuss.elastic.co/t/how-to-create-an-alerting-using-the-elk-stack-email-alerting-only/48662/7 "2017-07-06T04:59:46Z")