# Logstash throttle not triggering email, Is config missing something?

**URL:** https://discuss.elastic.co/t/logstash-throttle-not-triggering-email-is-config-missing-something/1618
**Category:** Logstash
**Created:** [June 1, 2015, 6:53am UTC](https://discuss.elastic.co/t/logstash-throttle-not-triggering-email-is-config-missing-something/1618 "2015-06-01T06:53:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Dnyaneshwar\_Sonawane](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@Dnyaneshwar\_Sonawane](https://discuss.elastic.co/u/Dnyaneshwar_Sonawane)
#### Post date: [June 1, 2015, 6:53am UTC](https://discuss.elastic.co/t/logstash-throttle-not-triggering-email-is-config-missing-something/1618/1 "2015-06-01T06:53:24Z")

</div>

Hi All ,  
I have setup which is working fine. but when i am trying to send conditional email using throttle its not working.

Please find the below config i am using,

input {  
lumberjack {  
port =\> 5000  
type =\> "logs"  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}

filter {  
if [type] == "mHood" {  
multiline {  
pattern =\> "^\s"  
what =\> "previous"  
}  
grok {  
match =\> { "message"=\> "%{TIMESTAMP\_ISO8601:logdate} %{LOGLEVEL:level} [%{DATA:thread}]%{DATA:classname}: %{GREEDYDATA:logdata}" }  
add\_field =\> ["received\_at", "%{@timestamp}"]  
add\_field =\> ["received\_from", "%{host}"]  
add\_tag =\> ["level\_%{level}"]  
}  
date {  
match =\> ["logdate", "yyyy-MM-dd HH:mm:ss,SSS"]  
}  
}  
if "Got ping response for sessionid" in [message] {  
grok {  
match =\> { "message"=\> "%{TIMESTAMP\_ISO8601:logdate} %{LOGLEVEL:level} [%{DATA:thread}]%{DATA:classname}: %{GREEDYDATA:logdata}" }  
add\_tag =\> ["got\_ping\_1"] }  
}  
if "got\_ping\_1" in [tags] {  
throttle {  
before\_count =\> 10  
after\_count =\> 15  
period =\> 3600  
key =\> "%{message}"  
add\_tag =\> "throttled\_got\_ping\_1"  
}  
}  
}

output {  
if "throttled\_got\_ping\_1" not in [tags] {  
if "got\_ping\_1" in [tags] {  
email {  
from =\> "logstash.alert@abc"  
subject =\> "Logstash Alert 2 "  
to =\> "dnyaneshwar.sonawane@abc.com"  
via =\> "smtp"  
body =\> "Here is the event line that occured: %{message}"  
htmlbody =\> "htmlbody commented\<!-- some --

## Logstash alert
  
  

### Full Event
  
  

%{message}
 --\>"  
}  
}}  
elasticsearch { host =\> localhost }  
}

throttle tags being created properly but throttle emails are not being generated .

can anyone suggest what i am missing ?

Thanks  
Dnyaneshwar

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 2, 2015, 11:44am UTC](https://discuss.elastic.co/t/logstash-throttle-not-triggering-email-is-config-missing-something/1618/2 "2015-06-02T11:44:43Z")

</div>

Try using debug to see what is happening?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/logstash-throttle-not-triggering-email-is-config-missing-something/1618/3 "2017-07-06T05:38:45Z")

</div>