# I want to configure threshold alert if totaltime exceeds 500 then mail should sent to the User
**URL:** https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136
**Category:** Elasticsearch
**Tags:** elastic-stack-reporting, elastic-stack-alerting
**Created:** [September 10, 2020, 8:53am UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136 "2020-09-10T08:53:16Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@AKumar123](https://discuss.elastic.co/u/AKumar123)
#### Post date: [September 10, 2020, 8:53am UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/1 "2020-09-10T08:53:16Z")
I am able to send mail with some information but Particular data i want to fetch in table.
Alert Configuration i pasted in this link:[https://pastebin.com/A6fDZYKY](https://pastebin.com/A6fDZYKY)
Field Name and index name as follows:
---
### Author:  [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)
#### Post date: [September 10, 2020, 9:16am UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/2 "2020-09-10T09:16:12Z")
Hi Anant
Glad I could help you with your code earlier. One thing I didn't correct in that code is the `"size": 0,` part. You should remove it because this is causing no document (hit) is returned, only the count! That's why you see no data. You could limit what fields are returned also if you want.
You could try to run just the `query` part of your watcher trough Kibana console (developer tools) to see if you'll get hits (you could also play with the time period to get more hits)
---
### Author:  [@AKumar123](https://discuss.elastic.co/u/AKumar123)
#### Post date: [September 10, 2020, 10:08am UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/3 "2020-09-10T10:08:29Z")
Yes It worked but data not coming in table form:
---
### Author:  [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)
#### Post date: [September 10, 2020, 10:30am UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/4 "2020-09-10T10:30:04Z")
Ok, did you sanitized HTML tags? Look [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/actions-email.html#email-html-sanitization)
You can inspect your watcher execution history to see what happened. In Kibana on the left side under the Elasticsearch group select Watcher, then from the list select your watcher, then from a list of execution history select one, e.g. most recent one. That will open a JSON file in the right part of your screen. Navigate towards the bottom of it and find the email action (if the watcher condition was met the action will be performed). There you should see your email HTML body, inspect it if it was constructed as you need it to be (are all the tags needed for a table there, or you can copy the whole HTML and paste it in some online HTML editor or something).
You can get the watcher execution result if you run it through developer tools (Kibana console) by executing
`PUT _watcher/watch/**/_execute`
and look for the email body as explained above.
P.S.
Copy the email body, hide the sensitive data (replace them with something) and paste it here so we can see it
---
### Author:  [@AKumar123](https://discuss.elastic.co/u/AKumar123)
#### Post date: [September 10, 2020, 11:12am UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/5 "2020-09-10T11:12:06Z")
> [@Josip\_Cagalj](#):
>
> PUT \_watcher/watch/_\_/\_execute
Yes I have configured:
xpack.notification.email.html.sanitization.allow: true
xpack.notification.email.html.sanitization:
allow: \_tables, \_blocks
disallow: h4, h5, h6
Watcher json Data:[{ "watch\_id": "9c92d55f-169d-4b9c-8671-4fff54f6e5cd", "node": "Ov4pBby1T7q - Pastebin.com](https://pastebin.com/SrBpts5X)
mail Output and alert Config:
> **[Mail Output:Hello Team,There are 4 long running process on these sever in th...](https://pastebin.com/Mj9Nph1Y)**
>
> Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.
elastic config:
---
### Author:  [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)
#### Post date: [September 10, 2020, 12:31pm UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/6 "2020-09-10T12:31:25Z")
If you're constructing the table as I showed you how, with the styles for ``, `| `, and ` | ` tags
```auto
"body": {
"html": " Hello Team,There are {{ctx.payload.hits.total}} long running process on these sever in the last minute. Find details below: | Server | Process | User | Time | {{#ctx.payload.hits.hits}} | {{_source.server}} | {{_source.process}} | {{_source.user}} | {{_source.totaltime}} | {{/ctx.payload.hits.hits}}
Regards, Team Admin "
}
```
then the problem could be that you need to add `_styles` to your allowed sanitized items. E.g. this is my settings:
```auto
xpack:
notification:
email:
html:
sanitization:
allow: "_tables, _blocks, _formating, _styles"
```
---
### Author:  [@AKumar123](https://discuss.elastic.co/u/AKumar123)
#### Post date: [September 11, 2020, 11:29am UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/7 "2020-09-11T11:29:22Z")
- List item
1. List item
Yes Thanks It worked for me.Thanks for the solution which you provided.
1. List item
I am using Kibana 7.9 Version and Using alert and Reporting feature with Trail One month License.My question is there any way i can install any plugin like sentinl which is not compatble with 7.9.
If you suggest any plugin which i can use free open source instead of buying license
---
### Author:  [@AKumar123](https://discuss.elastic.co/u/AKumar123)
#### Post date: [September 11, 2020, 6:27pm UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/8 "2020-09-11T18:27:02Z")
Hi Josip
Do you have idea
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 9, 2020, 6:27pm UTC](https://discuss.elastic.co/t/i-want-to-configure-threshold-alert-if-totaltime-exceeds-500-then-mail-should-sent-to-the-user/248136/9 "2020-10-09T18:27:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
|