# Problem with email\_from\_field use in elastalert

**URL:** <https://discuss.elastic.co/t/problem-with-email-from-field-use-in-elastalert/266688>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [March 9, 2021, 11:54am UTC](https://discuss.elastic.co/t/problem-with-email-from-field-use-in-elastalert/266688 "2021-03-09T11:54:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![LuigiDelavega](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\
**Post date:** [March 9, 2021, 11:54am UTC](https://discuss.elastic.co/t/problem-with-email-from-field-use-in-elastalert/266688/1 "2021-03-09T11:54:15Z")

</div>

Hello,

I have an issue using the email\_from\_field ... field. I created a basic alert, which is triggered (i tested without email\_from\_field and with the "email" filled).  
But i never received any mail on the mail transmitted by my alert.email.to field, with my "mail" field filled or not.  
So i guess the problem comes from my alert.email.to field ? This fields is added in my metricbeat data from metricbeat.yml fields with fields\_under\_root True.

Here is my alert file

```auto
es_host: localhost
es_port: 9200

name: test email LOUIS
index: metricbeat*system*
type: frequency

timeframe: 
    minutes: 10
num_events: 1

realert:
    minutes: 30

filter:
- range:
    system.memory.used.pct:
        from: 0
        to: 1.0
- term:
    metricset.name: memory
- term:
    host.name: Ordi500500

query_key: host.name

query_delay:
    minutes: 2

alert_text_type: alert_text_only
include : ["host.name"]

alert:
- "email"

email_from_field: "alert.email.to"

alert_subject: "[TEST ELK ALERT]"

alert_text: "TEST"

email:
- ""
cc:
- ""

smtp_host: Ordi500500
smtp_port: 25
from_addr: example@gmail.com

```

Thanks for your time,

Have a good day !

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2021, 11:55am UTC](https://discuss.elastic.co/t/problem-with-email-from-field-use-in-elastalert/266688/2 "2021-04-06T11:55:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.