# Send email when some events(start,error,etc) occurs

**URL:** https://discuss.elastic.co/t/send-email-when-some-events-start-error-etc-occurs/60553
**Category:** Logstash
**Created:** [September 14, 2016, 10:12pm UTC](https://discuss.elastic.co/t/send-email-when-some-events-start-error-etc-occurs/60553 "2016-09-14T22:12:44Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Octavius](https://avatars.discourse-cdn.com/v4/letter/o/f04885/32.png) [@Octavius](https://discuss.elastic.co/u/Octavius)
#### Post date: [September 14, 2016, 10:12pm UTC](https://discuss.elastic.co/t/send-email-when-some-events-start-error-etc-occurs/60553/1 "2016-09-14T22:12:44Z")

</div>

Hi,

I was testing logstash for a java application and it was looking good but in order to have a better solution i need to know if i can send an email when we have an ERROR or when the server starts(if we deploy our application). For example for a Java Jboss log, if an error occurs we can a see a message level "ERROR" and when an application start we can see this message in log "Started in".  
Someone knows if this is possible with logstash filters or a tool related to logstash like elastic or kibana?  
Currently we use file beat too.

Pleas help me.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 15, 2016, 5:41am UTC](https://discuss.elastic.co/t/send-email-when-some-events-start-error-etc-occurs/60553/2 "2016-09-15T05:41:53Z")

</div>

You can wrap an email output in a conditional that checks if the current event is an error. The problem with doing this is that there won't be any rate-limiting. If your application acts up and spews error messages you'll get flooded with email.

Another option could be to use Watcher or Elastalert.

---

<div class="post-metadata">

### Author: ![Octavius](https://avatars.discourse-cdn.com/v4/letter/o/f04885/32.png) [@Octavius](https://discuss.elastic.co/u/Octavius)
#### Post date: [September 15, 2016, 3:28pm UTC](https://discuss.elastic.co/t/send-email-when-some-events-start-error-etc-occurs/60553/3 "2016-09-15T15:28:03Z")

</div>

Hey Magnus, Thanks a lot.

Wich option is better: conditional, watcher of elastalert?

We have some applications from differents modules(example Ecommerce) and we want to send emails to the developers of that module when a error appears.

Best regards

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 15, 2016, 6:12pm UTC](https://discuss.elastic.co/t/send-email-when-some-events-start-error-etc-occurs/60553/4 "2016-09-15T18:12:52Z")

</div>

I haven't used either Watcher or Elastalert so I can't make a recommendation, but I suggest you don't use the email output for the reasons I mentioned previously.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:38am UTC](https://discuss.elastic.co/t/send-email-when-some-events-start-error-etc-occurs/60553/5 "2017-07-06T04:38:14Z")

</div>


