# Is the email plugin defunct in LS 2.1?

**URL:** <https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999>\
**Category:** Logstash\
**Created:** [December 1, 2015, 8:04am UTC](https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999 "2015-12-01T08:04:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bluethundr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bluethundr/32/409_2.png) [@bluethundr](https://discuss.elastic.co/u/bluethundr)\
**Post date:** [December 1, 2015, 8:04am UTC](https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999/1 "2015-12-01T08:04:41Z")

</div>

How can I enable e-mail alerting in LS 2.1?

This:

```
  # Alerting
    if [log_message] == "POSSIBLE BREAK-IN ATTEMPT!" {
  email {
  body => "Triggered in: %{message}"
  subject => "This is a Logstash alert for POSSIBLE BREAK-IN ATTEMPTS!"
  from => "logstash.alert@example.com"
  to => "admin@example.com"
  via => "sendmail"
 }
}

```

Yields the following:

```
[root@logs:/etc/logstash/conf.d] #/opt/logstash/bin/logstash --configtest --config 20-filters.conf
The error reported is:
  Couldn't find any filter plugin named 'email'. Are you sure this is correct? Trying to load the email filter plugin resulted in this error: no such file to load -- logstash/filters/email
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 1, 2015, 8:11am UTC](https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999/2 "2015-12-01T08:11:35Z")

</div>

The email plugin is an output plugin and has to be in the 'output' block of the configuration. Based on the error message it looks like you are trying to use it from the 'filter' block.

---

<div class="post-metadata">

**Author:** ![bluethundr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bluethundr/32/409_2.png) [@bluethundr](https://discuss.elastic.co/u/bluethundr)\
**Post date:** [December 1, 2015, 8:18am UTC](https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999/3 "2015-12-01T08:18:00Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> The email plugin is an output plugin and has to be in the 'output' block of the configuration. Based on the error message it looks like you are trying to use it from the 'filter' block.

Ah, ok. Thanks for the clarification.

```
output {
  elasticsearch {
hosts => [“10.10.10.25”, “10.10.10.26”, “10.10.10.27”]
index => "logstash-%{+YYYY.MM.dd}"
user => "ls_user"
  password => “secret”
  }
# Alerting
if [log_message] == "POSSIBLE BREAK-IN ATTEMPT!" {
   email {
  body => "Triggered in: %{message}"
  subject => "This is a Logstash alert for POSSIBLE BREAK-IN ATTEMPTS!"
  from => "logstash.alert@example.com"
  to => "admin@example.com"
  via => "sendmail"
   }
}
}

```

Gives:

```
[root@logs:/etc/logstash/conf.d] #/opt/logstash/bin/logstash --configtest --config 30-logstash-output.conf
Configuration OK

```

Thanks!!

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 1, 2015, 8:21am UTC](https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999/4 "2015-12-01T08:21:09Z")

</div>

I moved the discussion in Logstash group.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999/5 "2017-07-06T05:20:38Z")

</div>

Closed on July 6, 2017, 5:20am UTC