# Sending email on some event

**URL:** <https://discuss.elastic.co/t/sending-email-on-some-event/40540>\
**Category:** Logstash\
**Created:** [January 30, 2016, 7:52am UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540 "2016-01-30T07:52:10Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![abinay](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@abinay](https://discuss.elastic.co/u/abinay)\
**Post date:** [January 30, 2016, 7:52am UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/1 "2016-01-30T07:52:10Z")

</div>

Hii I am using logstash . I want to send an email on receiving a error log . This is my config -

if [loglevel] == "local.ERROR" or [loglevel] == "staging.ERROR" {  
email {  
from =\> "[abhi15@gmail.com](mailto:abhi15@gmail.com)"  
to =\> "[prithviabhi@gmail.com](mailto:prithviabhi@gmail.com)"  
body =\> "Dude your product has received a ERROR LOG !!!!!"  
}  
elasticsearch { hosts =\> ["localhost:9200"]  
index =\> "error\_logs-2016.01.08"  
}  
}  
but when a log gets pushed email could not be sent and this is what I get on the screen-

Something happen while delivering an email {:exception=\>#\<Errno::ECONNREFUSED: Connection refused - Connection refused\>, :level=\>:error}

I think i need to change some setting . What is the problem ??? Do i need to open a port to allow access or something ???

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 30, 2016, 10:02am UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/2 "2016-01-30T10:02:52Z")

</div>

This assumes you have an SMTP service running on localhost, do you?

---

<div class="post-metadata">

**Author:** ![abinay](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@abinay](https://discuss.elastic.co/u/abinay)\
**Post date:** [January 30, 2016, 12:15pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/3 "2016-01-30T12:15:56Z")

</div>

@warkolm doing netstat is not providing any result at port 25 to me . Further doing "telnet [www.gmail.com](http://www.gmail.com) " does nothing . I want to send email to a gmail user(though can be any).So what more I need to specify in my config?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 30, 2016, 2:20pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/4 "2016-01-30T14:20:21Z")

</div>

> Further doing "telnet [www.gmail.com](http://www.gmail.com) " does nothing .

[www.gmail.com](http://www.gmail.com) doesn't respond on the telnet port. It probably won't respond on any port except HTTP and HTTPS, actually.

> I want to send email to a gmail user(though can be any).So what more I need to specify in my config?

I think you should run an SMTP server on the same machine and configure Logstash to use it, but you could use another one on your local network instead. If none is available, use an outside relay. If Logstash can't send email it'll pause the log processing pipeline and you don't want that, which is why it's a good idea to make it as easy for Logstash to offload messages.

Once you've decided which server to use, the [email output's](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-email.html) documentation lists a few options that you'll need to adjust.

---

<div class="post-metadata">

**Author:** ![abinay](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@abinay](https://discuss.elastic.co/u/abinay)\
**Post date:** [January 30, 2016, 2:25pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/5 "2016-01-30T14:25:13Z")

</div>

@magnusbaeck so let just say i have my SMTP server running on the same machine as logstash . Will then I be able to email to a gmail user ??? Also let me know how can I test whether I already have SMTP server on my system or not ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 30, 2016, 3:41pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/6 "2016-01-30T15:41:42Z")

</div>

> so let just say i have my SMTP server running on the same machine as logstash . Will then I be able to email to a gmail user ???

Yes.

> Also let me know how can I test whether I already have SMTP server on my system or not ?

If something's answering on TCP port 25 that's a good sign.

---

<div class="post-metadata">

**Author:** ![abinay](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@abinay](https://discuss.elastic.co/u/abinay)\
**Post date:** [January 30, 2016, 4:02pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/7 "2016-01-30T16:02:47Z")

</div>

@magnusbaeck as i mentioned above doing -  
netstat -tulpn | grep ":25" does not give any output . So how to check otherwise ??

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 30, 2016, 4:10pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/8 "2016-01-30T16:10:44Z")

</div>

Well, that indicates that you don't have an SMTP server running. Unless you have another one on your local network I suggest you install one and configure it. I prefer Postfix. Over and out.

---

<div class="post-metadata">

**Author:** ![abinay](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@abinay](https://discuss.elastic.co/u/abinay)\
**Post date:** [January 30, 2016, 6:13pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/9 "2016-01-30T18:13:57Z")

</div>

@magnusbaeck copy that ................

---

<div class="post-metadata">

**Author:** ![abinay](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@abinay](https://discuss.elastic.co/u/abinay)\
**Post date:** [February 2, 2016, 8:08pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/10 "2016-02-02T20:08:39Z")

</div>

@magnusbaeck i have set up postfix smtp server and i m able to send emails by it too but when used in my logstash config as below i don't receive any mail on my gmail-

email {  
to =\> "prithviabhi00007@gmailcom"  
body =\> "ALERT!!!!!!!!"  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 2, 2016, 8:23pm UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/11 "2016-02-02T20:23:04Z")

</div>

There's a period missing from that the email address.

Anyway, for Postfix problems do read the Postfix logs for clues and reach out to Postfix experts for help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:13am UTC](https://discuss.elastic.co/t/sending-email-on-some-event/40540/12 "2017-07-06T05:13:21Z")

</div>


