# Watcher Email

**URL:** <https://discuss.elastic.co/t/watcher-email/182544>\
**Category:** Elasticsearch\
**Created:** [May 24, 2019, 3:15am UTC](https://discuss.elastic.co/t/watcher-email/182544 "2019-05-24T03:15:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hyhong](https://avatars.discourse-cdn.com/v4/letter/h/3bc359/32.png) [@hyhong](https://discuss.elastic.co/u/hyhong)\
**Post date:** [May 24, 2019, 3:15am UTC](https://discuss.elastic.co/t/watcher-email/182544/1 "2019-05-24T03:15:38Z")

</div>

The watcher email action send error,as follows:  
"error": {  
"root\_cause": [  
{  
"type": "messaging\_exception",  
"reason": "failed to send email with subject [xxx] via account [smtp\_account]"  
}  
],  
"type": "messaging\_exception",  
"reason": "failed to send email with subject [xxx] via account [smtp\_account]",  
"caused\_by": {  
"type": "authentication\_failed\_exception",  
"reason": "535 5.7.8 Error: authentication failed: authentication failure\n"  
}  
}  
But sometimes is ok,why?

---

<div class="post-metadata">

**Author:** ![jpcarey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpcarey/32/46668_2.png) [@jpcarey](https://discuss.elastic.co/u/jpcarey)\
**Post date:** [May 24, 2019, 3:45am UTC](https://discuss.elastic.co/t/watcher-email/182544/2 "2019-05-24T03:45:38Z")

</div>

Do all the nodes have the same settings? Cluster/shard changes could cause a different node to execute the watch (depending upon the version).

---

<div class="post-metadata">

**Author:** ![hyhong](https://avatars.discourse-cdn.com/v4/letter/h/3bc359/32.png) [@hyhong](https://discuss.elastic.co/u/hyhong)\
**Post date:** [May 24, 2019, 5:09am UTC](https://discuss.elastic.co/t/watcher-email/182544/3 "2019-05-24T05:09:54Z")

</div>

Yes,all node is set

---

<div class="post-metadata">

**Author:** ![jpcarey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpcarey/32/46668_2.png) [@jpcarey](https://discuss.elastic.co/u/jpcarey)\
**Post date:** [May 26, 2019, 6:43pm UTC](https://discuss.elastic.co/t/watcher-email/182544/4 "2019-05-26T18:43:24Z")

</div>

Is it possible that you have multiple mail servers behind the destination address that you are hitting with watcher, where one of those servers is rejecting with `535 5.7.8 Error: authentication failed: authentication failure`?

---

<div class="post-metadata">

**Author:** ![staodd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/staodd/32/24509_2.png) [@staodd](https://discuss.elastic.co/u/staodd)\
**Post date:** [May 26, 2019, 9:18pm UTC](https://discuss.elastic.co/t/watcher-email/182544/5 "2019-05-26T21:18:10Z")

</div>

Is it the same recipient on mails that work and those that don't?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 23, 2019, 9:18pm UTC](https://discuss.elastic.co/t/watcher-email/182544/6 "2019-06-23T21:18:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.