# Unable to send email using watcher on Xpack 6.2.1 **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [April 27, 2018, 4:41am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764 "2018-04-27T04:41:18Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![maheshm](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@maheshm](https://discuss.elastic.co/u/maheshm)\ **Post date:** [April 27, 2018, 4:41am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/1 "2018-04-27T04:41:18Z")
Hi, we are seeing an error through the essential SMTP configuration and other email action settings are enabled using X-Pack 6.2.1. Below is the facing error message, ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/9/f9933fd8693934de1a4139fd9bd5f88f900a870f.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/f/6fa9941137c9652df28ea397eff6206c77f842eb.png) Can someone please assist here? Regards Mahesh ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [April 27, 2018, 6:38am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/2 "2018-04-27T06:38:09Z")
Hey, I assume you did configure an email account? If so, can you possibly use the [execute watch API](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/watcher-api-execute-watch.html) with this particular and paste the response in here? This will ease debugging a lot. Thanks! --Alex ---
**Author:** ![maheshm](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@maheshm](https://discuss.elastic.co/u/maheshm)\ **Post date:** [April 30, 2018, 9:50am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/3 "2018-04-30T09:50:09Z")
> [@spinscale](#): > > will ease debugging a lot. Thanks Alexander. I could see below response coming from the ELK host [root@hostname ~]# POST \_xpack/watcher/watch/6dfb7d8a-e93f-4513-b508-76f3ee268861/\_execute Please enter content (application/x-www-form-urlencoded) to be POSTed: ---
**Author:** ![maheshm](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@maheshm](https://discuss.elastic.co/u/maheshm)\ **Post date:** [April 30, 2018, 10:14am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/4 "2018-04-30T10:14:03Z")
[root@hostname ~]# POST \_xpack/watcher/watch/6dfb7d8a-e93f-4513-b508-76f3ee268861/\_execute Please enter content (application/x-www-form-urlencoded) to be POSTed: This is from elk test email ^Z [1]+ Stopped POST \_xpack/watcher/watch/6dfb7d8a-e93f-4513-b508-76f3ee268861/\_execute ---
**Author:** ![maheshm](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@maheshm](https://discuss.elastic.co/u/maheshm)\ **Post date:** [May 7, 2018, 9:24am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/5 "2018-05-07T09:24:30Z")
Hi Alex, Did you get a chance to look in to this output? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [May 7, 2018, 10:35am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/6 "2018-05-07T10:35:07Z")
sorry, forgot to answer. This output does not help, my examples were meant to be pasted into the kibana devtools, where you just pasted them into a linux console and thus got weird responses. I am interested in the JSON responses of the above calls, when executed in kibana devtools. ---
**Author:** ![maheshm](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@maheshm](https://discuss.elastic.co/u/maheshm)\ **Post date:** [May 7, 2018, 11:43am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/7 "2018-05-07T11:43:22Z")
Below is the response from dev tools, { "\_id": "6dfb7d8a-e93f-4513-b508-76f3ee268861\_28fd79ac-47da-4323-bfcc-a17a25936dc2-2018-05-07T11:40:32.796Z", "watch\_record": { "watch\_id": "6dfb7d8a-e93f-4513-b508-76f3ee268861", "node": "0vYknH82RQmxnCMeQx7\_Dg", "state": "execution\_not\_needed", "status": { "state": { "active": true, "timestamp": "2018-05-07T11:35:20.971Z" }, "last\_checked": "2018-05-07T11:40:32.796Z", "actions": { "email\_1": { "ack": { "timestamp": "2018-05-04T12:13:01.917Z", "state": "awaits\_successful\_execution" } } }, "execution\_state": "execution\_not\_needed", "version": 5976 }, "trigger\_event": { "type": "manual", "triggered\_time": "2018-05-07T11:40:32.796Z", "manual": { "schedule": { "scheduled\_time": "2018-05-07T11:40:32.796Z" } } }, "input": { "search": { "request": { "search\_type": "query\_then\_fetch", "indices": [ "metricbeat-_" ], "types": [], "body": { "size": 0, "query": { "bool": { "filter": { "range": { "@timestamp": { "gte": "{{ctx.trigger.scheduled\_time}}||-30m", "lte": "{{ctx.trigger.scheduled\_time}}", "format": "strict\_date\_optional\_time||epoch\_millis" } } } } }, "aggs": { "metricAgg": { "max": { "field": "system.cpu.total.pct" } } } } } } }, "condition": { "script": { "source": "if (ctx.payload.aggregations.metricAgg.value \> params.threshold) { return true; } return false;", "lang": "painless", "params": { "threshold": 1000 } } }, "metadata": { "name": "TEST\_threshold", "watcherui": { "trigger\_interval\_unit": "m", "agg\_type": "max", "time\_field": "@timestamp", "trigger\_interval\_size": 10, "term\_size": 5, "time\_window\_unit": "m", "threshold\_comparator": "\>", "term\_field": null, "index": [ "metricbeat-_" ], "time\_window\_size": 30, "threshold": 1000, "agg\_field": "system.cpu.total.pct" }, "xpack": { "type": "threshold" } }, "result": { "execution\_time": "2018-05-07T11:40:32.796Z", "execution\_duration": 31, "input": { "type": "search", "status": "success", "payload": { "\_shards": { "total": 310, "failed": 0, "successful": 310, "skipped": 305 }, "hits": { "hits": [], "total": 240279, "max\_score": 0 }, "took": 30, "timed\_out": false, "aggregations": { "metricAgg": { "value": 6.705599784851074 } } }, "search": { "request": { "search\_type": "query\_then\_fetch", "indices": [ "metricbeat-\*" ], "types": [], "body": { "size": 0, "query": { "bool": { "filter": { "range": { "@timestamp": { "gte": "2018-05-07T11:40:32.796Z||-30m", "lte": "2018-05-07T11:40:32.796Z", "format": "strict\_date\_optional\_time||epoch\_millis" } } } } }, "aggs": { "metricAgg": { "max": { "field": "system.cpu.total.pct" } } } } } } }, "condition": { "type": "script", "status": "success", "met": false }, "actions": [] }, "messages": [] } } ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [May 7, 2018, 12:41pm UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/8 "2018-05-07T12:41:16Z")
please take the time and format your messages properly into code blocks. This leaves them pretty much unreadable (humans are pretty mediocre JSON parsers...) However, after looking it is expected that there is no action triggered. you can see `result.condition.met` is set to `false`, which means you condition did not turn true. If you further check out the JSON you see that your search resposne contains this value for the aggregation ```auto "value": 6.705599784851074 ``` Your condition however compares, if that value is greater than 1000... which is false, and thus no actions are fired. ---
**Author:** ![maheshm](https://avatars.discourse-cdn.com/v4/letter/m/58f4c7/32.png) [@maheshm](https://discuss.elastic.co/u/maheshm)\ **Post date:** [May 7, 2018, 5:46pm UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/9 "2018-05-07T17:46:34Z")
Many thanks, Alex. I have changed the condition and able to see below output in the results set: { "\_id": "6dfb7d8a-e93f-4513-b508-76f3ee268861\_151747ee-806e-45e7-bfc2-6d4b946c072f-2018-05-07T17:41:03.505Z", "watch\_record": { "watch\_id": "6dfb7d8a-e93f-4513-b508-76f3ee268861", "node": "0vYknH82RQmxnCMeQx7\_Dg", "state": "not\_executed\_already\_queued", "trigger\_event": { "type": "manual", "triggered\_time": "2018-05-07T17:41:03.505Z", "manual": { "schedule": { "scheduled\_time": "2018-05-07T17:41:03.505Z" } } }, "messages": [ "Watch is already queued in thread pool" ] } } But, I still do see the "internal server error" on the Test email action ☹ ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [May 8, 2018, 7:58am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/10 "2018-05-08T07:58:37Z")
The error message above is different. It means, that this watch is already waiting for execution in the thread pool queue and thus this execution has been cancelled early. Either you wait and retry or you use the execute watch API and provide the whole watch. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 5, 2018, 7:58am UTC](https://discuss.elastic.co/t/unable-to-send-email-using-watcher-on-xpack-6-2-1/129764/11 "2018-06-05T07:58:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.