# Watcher failed to send e-mail( via kibana)

**URL:** <https://discuss.elastic.co/t/watcher-failed-to-send-e-mail-via-kibana/208744>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [November 20, 2019, 5:13pm UTC](https://discuss.elastic.co/t/watcher-failed-to-send-e-mail-via-kibana/208744 "2019-11-20T17:13:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![elktester](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@elktester](https://discuss.elastic.co/u/elktester)\
**Post date:** [November 20, 2019, 5:13pm UTC](https://discuss.elastic.co/t/watcher-failed-to-send-e-mail-via-kibana/208744/1 "2019-11-20T17:13:37Z")

</div>

Hello!  
well, i'm new to elasticsearch, and i'm trying to configure elasticsearch to receive alerts, so for that i use the configuration below, but I couldn't send a test email, and everytime the following msg is displayed: error to send e-mail (via watcher)

i note also that i have already inserted the e-mail address i use in the whitelist by following the steps mentioned here : [https://www.elastic.co/guide/en/cloud/current/ec-watcher.html#ec-watcher](https://www.elastic.co/guide/en/cloud/current/ec-watcher.html#ec-watcher)

/etc/elasticsearch/elasticsearch.yml

#Section Index

xpack.notification.email.account

gmail\_account:

```
    profile: gmail

    smtp:

        auth: true

        starttls.enable: true

        host: [smtp.gmail.com](http://smtp.gmail.com/)

        port: 587

```

Please check the attached screenshot.

 ![1](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5be7c545cedc50c83b89598fb781073111bb5d70.png) ![2](https://us1.discourse-cdn.com/elastic/original/3X/4/0/40ef7784b7c219d3efb1dde8a33d520e06abf58c.png) ![3](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8ea232e7fdf407e0b12d0a71eb0f99d7ef321e15.png)

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 20, 2019, 5:39pm UTC](https://discuss.elastic.co/t/watcher-failed-to-send-e-mail-via-kibana/208744/2 "2019-11-20T17:39:01Z")

</div>

Please refrain from using screenshots for showing configuration items, this is really hard to read.

this is hard to tell without any error message. Any more information available.

I do not see a username configured and also you need to store the SMTP password in the keystore, see [https://www.elastic.co/guide/en/elasticsearch/reference/7.4/actions-email.html#gmail](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/actions-email.html#gmail)

---

<div class="post-metadata">

**Author:** ![elktester](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@elktester](https://discuss.elastic.co/u/elktester)\
**Post date:** [November 21, 2019, 10:43am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-e-mail-via-kibana/208744/3 "2019-11-21T10:43:07Z")

</div>

hello!

Here is the configuration used::  
/etc/elasticsearch/elasticsearch.yml

xpack.notification.email.account:  
gmail\_account:  
profile: gmail  
smtp:  
auth: true  
starttls.enable: true  
host: [smtp.gmail.com](http://smtp.gmail.com)  
port: 587  
user: ###@gmail.com  
password: \<####\>

root@test-ubuntu:/etc/elasticsearch# /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.notification.email.account.gmail\_account.smtp.secure\_password  
Enter value for xpack.notification.email.account.gmail\_account.smtp.secure\_password:

root@test-ubuntu:/etc/elasticsearch# sudo systemctl start elasticsearch

so the following error is displayed

Job for elasticsearch.service failed because the control process exited with error code.  
See "systemctl status elasticsearch.service" and "journalctl -xe" for details.

---

<div class="post-metadata">

**Author:** ![elktester](https://avatars.discourse-cdn.com/v4/letter/e/ea5d25/32.png) [@elktester](https://discuss.elastic.co/u/elktester)\
**Post date:** [November 21, 2019, 11:16am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-e-mail-via-kibana/208744/4 "2019-11-21T11:16:25Z")

</div>

systemctl edit elasticsearch  
Editing "/etc/systemd/system/elasticsearch.service.d/override.conf" canceled: temporary file is empty.  
root@test-ubuntu:/etc/elasticsearch# sudo systemctl status elasticsearch  
● elasticsearch.service - Elasticsearch  
Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; ve  
Active: failed (Result: timeout) since Thu 2019-11-21 12:05:50 +01; 9min a  
Docs: [http://www.elastic.co](http://www.elastic.co)  
Main PID: 2500 (code=exited, status=143)

nov. 21 12:04:16 test-ubuntu systemd[1]: Starting Elasticsearch...  
nov. 21 12:04:55 test-ubuntu elasticsearch[2500]: OpenJDK 64-Bit Server VM w  
nov. 21 12:05:46 test-ubuntu systemd[1]: elasticsearch.service: Start operat  
nov. 21 12:05:50 test-ubuntu systemd[1]: elasticsearch.service: Failed with  
nov. 21 12:05:50 test-ubuntu systemd[1]: Failed to start Elasticsearch.  
lines 1-11/11 (END)

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 21, 2019, 11:30am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-e-mail-via-kibana/208744/5 "2019-11-21T11:30:04Z")

</div>

can you check the elasticsearch logfiles or the journalctl output. See [https://www.elastic.co/guide/en/elasticsearch/reference/7.4/starting-elasticsearch.html#start-es-deb-systemd](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/starting-elasticsearch.html#start-es-deb-systemd)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 19, 2019, 11:30am UTC](https://discuss.elastic.co/t/watcher-failed-to-send-e-mail-via-kibana/208744/6 "2019-12-19T11:30:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
