# Logstash error while using email plugin

**URL:** <https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840>\
**Category:** Logstash\
**Created:** [August 3, 2018, 3:54am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840 "2018-08-03T03:54:14Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 3:54am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/1 "2018-08-03T03:54:14Z")

</div>

I am trying to simulate an environment wherein if the temperature exceeds 40℉, an email is sent to the user. I am running logstash on my local.

Here is the config file.

**weather\_data.conf**

```
input {
  http_poller {
    urls => {
        weather => {
            url => "http://api.openweathermap.org/data/2.5/weather?id=5490223&appid="MY_APP_ID"&units=metric"
            headers => {
              Accept => "application/json"
            }
        }
    }
    schedule => { cron => "* * * * * *" }
    codec => json
  }
}
filter {
  mutate {
    remove_field => ["@version" ,"command" ,"host" ,"cod" ,"id" ,"base" ,"coord" ,"sys" ,"dt"]
  }
  ruby{
	code => ' if Time.now.to_i % 120 == 0 ; event.set("[main][temp]", 15 + event.get("[main][temp]")); end'
  }
  split { field => "weather" }
}
output {
   if [main][temp] >= 40 {
	email {
	  to => 'john@gmail.com'
	  subject => 'Alert - Temperature exceeded threshold'
	  body => "Exceeded temperature"
	}
  }
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "weather"
  }
  stdout {
    codec => rubydebug
  }
}

```

Exactly two minutes after running the config file, I get an error like this,

```
[2018-08-02T20:22:22,004][INFO][logstash.inputs.http_poller] Registering http_poller Input {:type=>nil, :schedule=>{"cron"=>"* * * * * *"}, :timeout=>nil}
[2018-08-02T20:22:22,082][INFO][logstash.pipeline] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0xca32fb8 run>"}
[2018-08-02T20:22:22,238][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2018-08-02T20:22:22,898][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2018-08-02T20:24:02,700][ERROR][logstash.outputs.email] Something happen while delivering an email {:exception=>#<Errno::ECONNREFUSED: Connection refused - connect(2) for "localhost" port 25>}

```

What wrong am I doing? How can I make sure the email is sent? Do I have to include the logstash port?

Can someone please help me out here? I would really appreciate if you could. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 3, 2018, 5:47am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/2 "2018-08-03T05:47:26Z")

</div>

How are you planning to send the email? Do you SMTP access or will it be a mailbox?

You might need to specify the address or domain and the auth setting if needed to send the email.

> **[Email output plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-email.html)**

Here is another config that you could look at:

> [@Using logstash-output-email plugin](https://discuss.elastic.co/t/using-logstash-output-email-plugin/75074):
>
> Hi everyone, Before all, sorry for my English, it's not my native language. I try to configure Logstash for sending mail when some specific events coming with the logstash-output-email plugin. I'm using SMTPS mail server on port 465 ( the same as me, which is working for my user. ) my configuration file look like to that : filter { grok { match =\> { "severity" =\> "warning" } add\_tag =\> ["warning"] } } output { if "warning" in [tags…

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 3, 2018, 5:51am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/3 "2018-08-03T05:51:35Z")

</div>

> [@APJ](#):
>
> [2018-08-02T20:24:02,700][ERROR][logstash.outputs.email] Something happen while delivering an email {:exception=\>#\<Errno::ECONNREFUSED: Connection refused - connect(2) for "localhost" port 25\>}

Also, are you running anything like postfix or sendmail locally? Try doing `telnet localhost 25`.

---

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 5:54am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/4 "2018-08-03T05:54:37Z")

</div>

Hi NerdSec,

Not really sure what SMTP access is. I haven't actually set anything. For testing purpose, I only want to send an email to my personal email ID (I presume this means mailbox). Also, logstash is running on localhost. How should I go about doing this?

---

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 6:00am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/5 "2018-08-03T06:00:13Z")

</div>

I tried running `telnet localhost 25`

I get the following error,

```
PS C:\Windows\System32\WindowsPowerShell\v1.0> telnet localhost 25
Connecting To localhost...Could not open connection to the host, on port 25: Connect failed

```

Could you please tell me how I can fix this?

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 3, 2018, 6:05am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/6 "2018-08-03T06:05:27Z")

</div>

Ok. So you don't have access to an SMTP or a mailbox locally.

Why don't you send an email via Gmail itself?

Try doing the following:  
`telnet smtp.gmail.com 587`

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 3, 2018, 6:08am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/7 "2018-08-03T06:08:28Z")

</div>

If you are able to telnet then try using the following config:

```auto
email {
  to => "xyz@gmail.com"
  body => "Message: %{message}"
  address => "smtp.gmail.com"
  port => 587
  username => "xyz@gmail.com"
  password => "mypass"
  use_tls => true
}

```

---

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 6:09am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/8 "2018-08-03T06:09:17Z")

</div>

Thanks! I did as you said.

I got an output like this,

`220 smtp.gmail.com ESMTP s14-v6sm8644374pfj.105 - gsmtp`

Also, As per my logstash configuration I am sending an email through gmail right?

---

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 6:20am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/9 "2018-08-03T06:20:13Z")

</div>

Here is my updated logstash config

```
input {
  http_poller {
    urls => {
        weather => {
            url => "http://api.openweathermap.org/data/2.5/weather?id=5490223&appid="MY_APP_ID"&units=metric"
            headers => {
              Accept => "application/json"
            }
        }
    }
    schedule => { cron => "* * * * * *" }
    codec => json
  }
}
filter {
  mutate {
    remove_field => ["@version" ,"command" ,"host" ,"cod" ,"id" ,"base" ,"coord" ,"sys" ,"dt"]
  }
  ruby{
	code => ' if Time.now.to_i % 15 == 0 ; event.set("[main][temp]", 15 + event.get("[main][temp]")); end'
  }
  split { field => "weather" }
}
output {
  email {
    to => "myusername@gmail.com"
    body => "Message: %{message}"
    address => "smtp.gmail.com"
    port => 587
    username => "myusername@gmail.com"
    password => "mypassword"
    use_tls => true
  }
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "weather"
  }
  stdout {
    codec => rubydebug
  }
}

```

When i try running the config file, I get an error like this,

```
[2018-08-02T23:15:58,498][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2018-08-02T23:16:02,653][ERROR][logstash.outputs.email] Something happen while delivering an email {:exception=>#<Net::SMTPAuthenticationError: 534-5.7.14 <https://accounts.google.com/signin/continue?sarp=1&scc=1&plt=AKgnsbsQ
>}
[2018-08-02T23:16:03,596][ERROR][logstash.outputs.email] Something happen while delivering an email {:exception=>#<Net::SMTPAuthenticationError: 534-5.7.14 <https://accounts.google.com/signin/continue?sarp=1&scc=1&plt=AKgnsbvY
>}
```

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 3, 2018, 6:22am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/10 "2018-08-03T06:22:21Z")

</div>

Are you using 2FA with Gmail? If so, you might have to use App passwords.

[https://support.google.com/accounts/answer/185833](https://support.google.com/accounts/answer/185833)

---

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 6:26am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/11 "2018-08-03T06:26:17Z")

</div>

I am not using 2FA. 2FA is not available for my account.

 ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/4/3/43cb4eab817ee9611365f6c665120ca6ef63b739.PNG)

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 3, 2018, 6:29am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/12 "2018-08-03T06:29:29Z")

</div>

> [@APJ](#):
>
> {:exception=\>#\<Net::SMTPAuthenticationError:

Then, are you sure the password is correct? It seems to be an authentication error.

---

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 6:33am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/13 "2018-08-03T06:33:02Z")

</div>

Yes. Password is absolutely right. I even successfully logged in through using chrome browser.

---

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [August 3, 2018, 7:28am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/14 "2018-08-03T07:28:13Z")

</div>

I have successfully tested this on my setup and the following config works perfectly fine:

```auto
email {
      to => "nerdsec@gmail.com"
      body => "Message: %{message}"
      address => "smtp.gmail.com"
      port => 587
      username => "nerdsec@gmail.com"
      password => "lasdasd"
      use_tls => true
}

```

I am using 2FA so, have used an App password for authentication.

---

<div class="post-metadata">

**Author:** ![tgaudin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tgaudin/32/32583_2.png) [@tgaudin](https://discuss.elastic.co/u/tgaudin)\
**Post date:** [August 3, 2018, 7:45am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/15 "2018-08-03T07:45:02Z")

</div>

You need to enable "Less secure apps" (sic) in your Gmail account if you want to connect to it via SMTP without a dedicated app password: [https://support.google.com/accounts/answer/6010255?hl=en](https://support.google.com/accounts/answer/6010255?hl=en)

---

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 8:07am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/16 "2018-08-03T08:07:47Z")

</div>

Thanksa lot! It works now! 🙂

---

<div class="post-metadata">

**Author:** ![APJ](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@APJ](https://discuss.elastic.co/u/APJ)\
**Post date:** [August 3, 2018, 8:09am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/17 "2018-08-03T08:09:02Z")

</div>

I had to change my google settings to allow less secure apps! After making the settings, it worked! Thanks a lot again NerdSec! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2018, 8:09am UTC](https://discuss.elastic.co/t/logstash-error-while-using-email-plugin/142840/18 "2018-08-31T08:09:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.