Sending email while Alert

elleuch · June 14, 2018, 3:02pm

I want to send emails with watcher menu in Kibana. I tried a configuration in elasticsarch.yml and I don't know why it never arrived to send emails. What should I write in the elasticsearch.yml? and shoud I add another thing in an other file to activate watcher.
Thank you.

This is my code :
xpack.notification.email.account:
gmail_account:
profile: gmail
smtp:
auth: true
starttls.enable: true
host: smtp.gmail.com
port: 587
user:
password:

ps: I don't know what to write in user and password

richcollier · June 15, 2018, 1:11am

It's the username and password of the gmail account that you want to use to send the email from.

(I assume you have a gmail account that you can use for this purpose)

elleuch · June 15, 2018, 7:42am

Yes I had them. I printed them and then when I send an email for someone else, it mentionned an error with watcher.

richcollier · June 15, 2018, 12:35pm

It's a little hard to help without knowing what you actually put in your elasticsarch.yml configuration or what you put in your email action or your watch, or the relevant output of the elasticsearch.log file where surely more detailed error messages occur.

So, feel free to provide those (and redact sensitive information as necessary).

Also, there are plenty of others who've encountered the same questions. Might be good to look through these:

https://discuss.elastic.co/search?q=%22failed%20to%20send%20email%22%20gmail

The most probable answer is that you've not enabled your gmail to send email from 3rd party apps.

elleuch · June 15, 2018, 12:42pm

Thank you for you answer.
this is my elasticserach.yml :

xpack.watcher.enabled : true
action.auto_create_index: .watches,.triggered_watches,.watcher-history*

xpack.notification.email.account:
gmail_account:
profile: gmail
smtp:
auth: true
starttls.enable: true
host: smtp.gmail.com
port: 587
user: *****
password: *****

How can I enable gmail to send email from 3rd party apps?

As I am strating learning ELK stack, Watcher can be send from Kibana directly. Is there something should be configured to enable watchers?

Or should I print the watches just like :
"actions" : {
"send_email" : {
"email" : {
"to" : "@",
"subject" : "Watcher Notification",
"body" : "{{ctx.payload.hits.total}} error logs found"
}
}
}

Thank you.

richcollier · June 15, 2018, 12:48pm

Please also include the relevant errors seen in elasticsearch.log.

Information on gmail external access via IMAP and troubleshooting:

https://support.google.com/mail/answer/7126229

elleuch · June 15, 2018, 12:52pm

I think it is a problem in configuration in gmail account. I will take a look.
By the way, here is the error :

[2018-06-15T14:24:21,235][ERROR][o.e.x.w.a.e.ExecutableEmailAction] [Lh5V5GQ] failed to execute action [inlined/email_1]
javax.mail.MessagingException: failed to send email with subject [Watch [sdf] has exceeded the threshold] via account [gmail_account]
at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:154) ~[?:?]
at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:146) ~[?:?]
at org.elasticsearch.xpack.watcher.actions.email.ExecutableEmailAction.execute(ExecutableEmailAction.java:84) ~[?:?]
at org.elasticsearch.xpack.core.watcher.actions.ActionWrapper.execute(ActionWrapper.java:156) [x-pack-core-6.2.4.jar:6.2.4]
at org.elasticsearch.xpack.watcher.execution.ExecutionService.executeInner(ExecutionService.java:487) [x-pack-watcher-6.2.4.jar:6.2.4]
at org.elasticsearch.xpack.watcher.execution.ExecutionService.execute(ExecutionService.java:317) [x-pack-watcher-6.2.4.jar:6.2.4]
at org.elasticsearch.xpack.watcher.transport.actions.execute.TransportExecuteWatchAction$1.doRun(TransportExecuteWatchAction.java:165) [x-pack-watcher-6.2.4.jar:6.2.4]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.2.4.jar:6.2.4]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_171]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_171]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:573) [elasticsearch-6.2.4.jar:6.2.4]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_171]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_171]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_171]
Caused by: javax.mail.AuthenticationFailedException: 534-5.7.14 <https://accounts.google.com/signin/continue?sarp=1&scc=1&plt=AKgnsbtI
534-5.7.14 HDpnJShYt8gUgQzoASKg0B5ZMFt8c0eIQp4QPhDSOfaQBTZYpep4p5GObxQ57-XUmv20nT
534-5.7.14 w94_IgG43PHKlfSKqU_a5gehv42PACc5zvI-7dixauKZEgXccF3-8Iw_fbqH14Vo4Nh4TC
534-5.7.14 hzvdMAGeXqUI6xsghmOEc5ZZIeeLepHwLmdvqPXaW5lth5kLhgfZOFhbvKvKQS4gjWhWdG
534-5.7.14 QDqz-9ZcTnTtFjhIeeAA-EO5ume9E> Please log in via your web browser and
534-5.7.14 then try again.
534-5.7.14 Learn more at
534 5.7.14 https://support.google.com/mail/answer/78754 y8-v6sm9934645wrq.35 - gsmtp

at com.sun.mail.smtp.SMTPTransport$Authenticator.authenticate(SMTPTransport.java:932) ~[?:?]
at com.sun.mail.smtp.SMTPTransport.authenticate(SMTPTransport.java:843) ~[?:?]
at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:748) ~[?:?]
at javax.mail.Service.connect(Service.java:366) ~[?:?]
at org.elasticsearch.xpack.watcher.notification.email.Account.lambda$executeConnect$2(Account.java:165) ~[?:?]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_171]
at org.elasticsearch.xpack.watcher.notification.email.Account.executeConnect(Account.java:164) ~[?:?]
at org.elasticsearch.xpack.watcher.notification.email.Account.send(Account.java:123) ~[?:?]
at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:152) ~[?:?]
... 13 more

[2018-06-15T14:38:39,614][ERROR][o.e.x.w.a.e.ExecutableEmailAction] [Lh5V5GQ] failed to execute action [inlined/email_1]
javax.mail.MessagingException: failed to send email with subject [Watch [sdf] has exceeded the threshold] via account [gmail_account]
at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:154) ~[?:?]
at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:146) ~[?:?]
at org.elasticsearch.xpack.watcher.actions.email.ExecutableEmailAction.execute(ExecutableEmailAction.java:84) ~[?:?]
at org.elasticsearch.xpack.core.watcher.actions.ActionWrapper.execute(ActionWrapper.java:156) [x-pack-core-6.2.4.jar:6.2.4]
at org.elasticsearch.xpack.watcher.execution.ExecutionService.executeInner(ExecutionService.java:487) [x-pack-watcher-6.2.4.jar:6.2.4]
at org.elasticsearch.xpack.watcher.execution.ExecutionService.execute(ExecutionService.java:317) [x-pack-watcher-6.2.4.jar:6.2.4]
at org.elasticsearch.xpack.watcher.transport.actions.execute.TransportExecuteWatchAction$1.doRun(TransportExecuteWatchAction.java:165) [x-pack-watcher-6.2.4.jar:6.2.4]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.2.4.jar:6.2.4]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_171]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_171]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingRunnable.run(ThreadContext.java:573) [elasticsearch-6.2.4.jar:6.2.4]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_171]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_171]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_171]
Caused by: javax.mail.AuthenticationFailedException: 534-5.7.14 <https://accounts.google.com/signin/continue?sarp=1&scc=1&plt=AKgnsbuE
534-5.7.14 J6WrK60cif0Kn2jTqo-dBbTfFtuJCAGw6xHlfRSn2CHhknOoIOZ4Gy6HounAoswmLeNzg3
534-5.7.14 690b4sdfEjugMR73n9LID6tTgbu0cE70f5EqRXQTWm33XGEfW5ZS9S6bX_DhXVdXj6mPPn
534-5.7.14 Y0mBAk7iK5TrwS4dOKV8ZnuZ7yBrL6ZMgUD5sWmr4psLRtuE5jXpDucOvpg2aDCzMp9BQ_
534-5.7.14 r7wChHkgQoW8s5OHg0oKHxaF3UZZU> Please log in via your web browser and
534-5.7.14 then try again.
534-5.7.14 Learn more at
534 5.7.14 https://support.google.com/mail/answer/78754 n12-v6sm6924675wrp.69 - gsmtp

at com.sun.mail.smtp.SMTPTransport$Authenticator.authenticate(SMTPTransport.java:932) ~[?:?]
at com.sun.mail.smtp.SMTPTransport.authenticate(SMTPTransport.java:843) ~[?:?]
at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:748) ~[?:?]
at javax.mail.Service.connect(Service.java:366) ~[?:?]
at org.elasticsearch.xpack.watcher.notification.email.Account.lambda$executeConnect$2(Account.java:165) ~[?:?]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_171]
at org.elasticsearch.xpack.watcher.notification.email.Account.executeConnect(Account.java:164) ~[?:?]
at org.elasticsearch.xpack.watcher.notification.email.Account.send(Account.java:123) ~[?:?]
at org.elasticsearch.xpack.watcher.notification.email.EmailService.send(EmailService.java:152) ~[?:?]

spinscale · June 22, 2018, 2:18pm

please check the exception that also includes a link to google support, especially if you are using 2FA, two factor authentication. Authentication did not work as expected, which requires you to do some more steps to set up everything properly on the google side.

Hope this helps!

--Alex

system · July 20, 2018, 2:18pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Unable to send email with watcher Kibana elastic-stack-alerting	3	766	January 6, 2022
Elasticsearch Alert Email not working - Watcher Elasticsearch elastic-stack-alerting	12	2809	June 22, 2020
Email sending failed on my watcher alert Elasticsearch	7	2799	March 31, 2020
Watcher email configuration Elasticsearch elastic-stack-alerting	2	1614	December 19, 2019
Error Configuring Email for Watcher Kibana 7.3.2 Kibana elastic-stack-alerting	4	390	March 25, 2021

Sending email while Alert

Related Topics