How to create an alerting using the ELK stack(email alerting only)

[fbaligand (Fabien Baligand)]

As output, you can use "email" output plugin. I presume you already guess that.

In filter part, you add tag "email" to events that are relevant for an email.

And in output part :
output {
if "email" in [tags] {
email {
...
}
}
}

That said, in filter part, all depends what you exactly want to do...