Take a look at your watcher history to see what might be going on. For example:
GET .watcher-history-*/_search?size=100
{
"sort" : [
{ "@timestamp": "desc"}
]
}
If nothing stands out there, enabled debug logging for watcher, and see what is in your logs. For example:
PUT /_cluster/settings
{
"persistent": {
"org.elasticsearch.xpack.watcher": "DEBUG"
}
}
Another thing to check is your SMTP server log -- several times I have seen a problem in the SMTP server, and Elasticsearch won't know anything about that.