# Question about email notification alert

**URL:** <https://discuss.elastic.co/t/question-about-email-notification-alert/314044>\
**Category:** Elasticsearch\
**Created:** [September 9, 2022, 9:31am UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044 "2022-09-09T09:31:06Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 9, 2022, 9:31am UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/1 "2022-09-09T09:31:07Z")

</div>

does elasticsearch SIEM email notification alert is free in the current version of elastic stack 8.4.1 ?? I heard that this tool is gold or somethinglike that i don't know more about it.  
or i will use elasticalert?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [September 9, 2022, 12:49pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/2 "2022-09-09T12:49:01Z")

</div>

No. email notification needs a platinum license for on premise. [Subscriptions | Elastic Stack Products & Support | Elastic](https://www.elastic.co/subscriptions) see Alerting

It needs a Gold level for the cloud service. See [Elastic Cloud Feature Matrix | Elastic](https://www.elastic.co/subscriptions/cloud)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 9, 2022, 1:11pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/3 "2022-09-09T13:11:58Z")

</div>

The only actions available in the alerts with the Basic license are the log action, which will write a log line in Kibana's log, and the index action, which will write the alert in some index.

To get an e-mail you will need to use a third party tool like elastalert or you can also use the index action and create a simple tool to read from the index and send your e-mails.

---

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 9, 2022, 2:07pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/4 "2022-09-09T14:07:36Z")

</div>

thanks @dadoonet for your response what you mean by the word "license" i'am a new in elasticsearch and i know the word "version" for exp and i installed the elastic stack in ubuntu VM

---

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 9, 2022, 2:09pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/5 "2022-09-09T14:09:16Z")

</div>

thanks @leandrojmp for the response how can i do the sencond method ?

> [@leandrojmp](#):
>
> you can also use the index action and create a simple tool to read from the index and send your e-mails.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 9, 2022, 2:17pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/6 "2022-09-09T14:17:04Z")

</div>

You will need to build something, maybe a python script using the elasticsearch python client to query the index and trigger the e-mail.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [September 9, 2022, 2:20pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/7 "2022-09-09T14:20:43Z")

</div>

> [@morad\_della3](#):
>
> what you mean by the word "license"

A commercial license.

---

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 9, 2022, 2:30pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/8 "2022-09-09T14:30:28Z")

</div>

> [@dadoonet](#):
>
> A commercial license.

ok thanks @dadoonet

---

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 9, 2022, 2:30pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/9 "2022-09-09T14:30:53Z")

</div>

thanks @leandrojmp

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2022, 2:30pm UTC](https://discuss.elastic.co/t/question-about-email-notification-alert/314044/10 "2022-10-07T14:30:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
