# How to send Query output as an Email

**URL:** <https://discuss.elastic.co/t/how-to-send-query-output-as-an-email/180268>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 8, 2019, 11:58pm UTC](https://discuss.elastic.co/t/how-to-send-query-output-as-an-email/180268 "2019-05-08T23:58:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jskharay](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jskharay](https://discuss.elastic.co/u/jskharay)\
**Post date:** [May 8, 2019, 11:58pm UTC](https://discuss.elastic.co/t/how-to-send-query-output-as-an-email/180268/1 "2019-05-08T23:58:54Z")

</div>

Hi Everyone,

I'm stuck at an simple query.

Thing is that we need to send an alert email to administrator if there are more than 3 exception came into process. Exceptions are covered under TransactionStatus key in json.

With below query, I'm able to get the exceptions detail but not aware of that how to send email this output.

GET /\_search  
{  
"\_source": {  
"includes": [  
"timeStamp",  
"logF\_BusinessProcessName",  
"logF\_TransactionNumber",  
"logF\_TransactionField1",  
"logF\_TransactionField2",  
"logF\_TransactionField3",  
"logF\_TransactionField4",  
"logF\_TransactionField5",  
"logF\_TransactionField6",  
"logF\_TransactionField7",  
"message"]  
},  
"query": {  
"bool": {  
"must": [  
{ "match": { "logF\_TransactionStatus": "ApplicationException" }},  
{ "match": { "processName": "XXXXXXXXXX" }}],  
"must\_not": [  
{ "match": { "level": "Error" }},  
{ "match": { "level": "Warn" }}  
],  
"filter": {  
"range": { "timeStamp": { "gte": "now-1h" }}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 9, 2019, 10:01am UTC](https://discuss.elastic.co/t/how-to-send-query-output-as-an-email/180268/2 "2019-05-09T10:01:43Z")

</div>

You need to create a watch in order to do this. The next step would be to get accustomized with alerting and how to use it, and then send email with it

[https://www.elastic.co/guide/en/elastic-stack-overview/7.0/watcher-getting-started.html](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/watcher-getting-started.html)  
[https://www.elastic.co/guide/en/elastic-stack-overview/7.0/how-watcher-works.html](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/how-watcher-works.html)  
[https://www.elastic.co/guide/en/elastic-stack-overview/7.0/actions-email.html](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/actions-email.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2019, 10:01am UTC](https://discuss.elastic.co/t/how-to-send-query-output-as-an-email/180268/3 "2019-06-06T10:01:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.