# Not receiving email from watcher

**URL:** <https://discuss.elastic.co/t/not-receiving-email-from-watcher/205351>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 26, 2019, 10:52am UTC](https://discuss.elastic.co/t/not-receiving-email-from-watcher/205351 "2019-10-26T10:52:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Muhammad\_Irfan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muhammad_irfan/32/47241_2.png) [@Muhammad\_Irfan](https://discuss.elastic.co/u/Muhammad_Irfan)\
**Post date:** [October 26, 2019, 10:52am UTC](https://discuss.elastic.co/t/not-receiving-email-from-watcher/205351/1 "2019-10-26T10:52:57Z")

</div>

Dears,  
Greetings, I am new in ELK cluster and try to create watcher on my laptop, email configuration set on elastisearch.yml file but don't get emails.  
Secondly, I am bit confused in transform in watcher.  
Do i need to apply transformer in this watcher, if yes then how can i apply on which fields ?  
Task : ELK work as a anti-spam filter and my task is watcher trigger email if sender is not from "for e.g Germany" country and domain should not be ".com"  
please find below my watcher..

# code block

{  
"trigger": {  
"schedule": {  
"interval": "3m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"filebeat-cloudmark-_"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"must\_not": [  
{  
"match": {  
"geoip.country\_name": "Germany"  
}  
},  
{  
"wildcard": {  
"sender": {  
"value": "_.com"  
}  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-10m",  
"lte": "now",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
}  
}  
}  
]  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.aggregations.spam\_sender.buckets.0.doc\_count": {  
"gte": 4  
}  
}  
},  
"actions": {  
"email\_admin": {  
"email": {  
"profile": "standard",  
"to": [  
[abc@xyz.com](mailto:abc@xyz.com)"  
],  
"subject": "email notification",  
"body": {  
"text": "{{ctx.payload.aggregations.spam\_sender.buckets.0.doc\_count}} email"  
}  
}  
}  
}  
}

* * *

Watcher output :

... #code block

{  
"watch\_id": "_inlined_",  
"node": "9jgRfxrkQeOLrDanG-wLvg",  
"state": "execution\_not\_needed",  
"user": "muhammadqureshi",  
"status": {  
"state": {  
"active": true,  
"timestamp": "2019-10-26T09:54:22.302Z"  
},  
"last\_checked": "2019-10-26T09:54:22.302Z",  
"actions": {  
"email\_admin": {  
"ack": {  
"timestamp": "2019-10-26T09:54:22.302Z",  
"state": "awaits\_successful\_execution"  
}  
}  
},  
"execution\_state": "execution\_not\_needed",  
"version": -1  
},  
"trigger\_event": {  
"type": "manual",  
"triggered\_time": "2019-10-26T09:54:22.302Z",  
"manual": {  
"schedule": {  
"scheduled\_time": "2019-10-26T09:54:22.302Z"  
}  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"filebeat-cloudmark-_"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"must\_not": [  
{  
"match": {  
"geoip.country\_name": "United Arab Emirates"  
}  
},  
{  
"wildcard": {  
"sender": {  
"value": "_.ae"  
}  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-10m",  
"lte": "now",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
}  
}  
}  
]  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.aggregations.spam\_sender.buckets.0.doc\_count": {  
"gte": 4  
}  
}  
},  
"metadata": {  
"xpack": {  
"type": "json"  
}  
},  
"result": {  
"execution\_time": "2019-10-26T09:54:22.302Z",  
"execution\_duration": 6,  
"input": {  
"type": "search",  
"status": "success",  
"payload": {  
"\_shards": {  
"total": 31,  
"failed": 0,  
"successful": 31,  
"skipped": 0  
},  
"hits": {  
"hits": ,  
"total": 10000,  
"max\_score": null  
},  
"took": 6,  
"timed\_out": false  
},  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"filebeat-cloudmark-_"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"must\_not": [  
{  
"match": {  
"geoip.country\_name": "United Arab Emirates"  
}  
},  
{  
"wildcard": {  
"sender": {  
"value": "_.ae"  
}  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-10m",  
"lte": "now",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
}  
}  
}  
]  
}  
}  
}  
}  
}  
},  
"condition": {  
"type": "compare",  
"status": "success",  
"met": false,  
"compare": {  
"resolved\_values": {  
"ctx.payload.aggregations.spam\_sender.buckets.0.doc\_count": null  
}  
}  
},  
"actions":   
},  
"messages":   
}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 31, 2019, 12:27pm UTC](https://discuss.elastic.co/t/not-receiving-email-from-watcher/205351/2 "2019-10-31T12:27:17Z")

</div>

Please take your time to properly format your messages. This forum supports markdown, which allows for code snippets. Thank you!

The reason why your email does not get send is here

```auto
"condition": {
"type": "compare",
"status": "success",
"met": false,
"compare": {
"resolved_values": {
"ctx.payload.aggregations.spam_sender.buckets.0.doc_count": null
}
}

```

The condition from your watch is false and thus no action is triggered. It looks to me, as if your search request does not ask for aggregations, so no matter how many documents are returned, no aggregation results are created.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 28, 2019, 12:27pm UTC](https://discuss.elastic.co/t/not-receiving-email-from-watcher/205351/3 "2019-11-28T12:27:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.