Non multi-part Emails with Watch Email Action

Elastic Stack Elasticsearch
1

We have a requirement to send automated emails to another monitoring system. We wanted to use watcher for this but unfortunately that second system cannot handle multi-part emails, only text/plain emails. I know its a stretch that xpack supports this, but I've looked through the configuration of cluster email settings and watch email action settings and i'm not seeing anything that will send a non-multi-part plain-text email. Is there any way to achieve this with the current implementation of xpack?

Our watch action does not supply a body.html, only a body.text and no attachments.

2

Currently everything is treated as a MIME MultiPart, regardless if you specify text or HTML. See https://github.com/elastic/elasticsearch/blob/master/x-pack/plugin/watcher/src/main/java/org/elasticsearch/xpack/watcher/notification/email/Profile.java#L68-L85

3

Is there any possibility you can alert the system in a different way?

Also I was thinking to use a webhook to send data to logstash and then use the email output of logstash, but I think logstash is using multipart emails as well (my ruby skills are literally non-existing, so testing this might make sense). See https://github.com/logstash-plugins/logstash-output-email/blob/master/lib/logstash/outputs/email.rb

4

Thank you. The only option is email for that system. Staring at the Logstash ruby code, it looks like it may support plain/text email so if it comes to that, we'll give it a try. Not that this situation is a very common one (or generally desired) but maybe a feature enhancement to allow more fine grain controls of the email contents can be added to XPack? Seems like there are a bunch of legacy monitoring systems at large companies out there where email is the easiest integration.

Thank you for your help.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.