How to set email alert to send the logs or specific logs to a email using my email?

Indices config—

Streams config----

Streams rule—

Alert condition—

Alert notification setting—

Please post your SMTP config in graylog server.conf. Probably you didn’t setup it correctly, or your firewall is blocking port 465 to internet.


Try these:

  1. Change transport_email_from_email = to your real gmail email adress (same as used in transport_email_auth_username
  2. Check that your firewall don’t block port 587/tcp to from graylog box
  3. Enable Less secure apps in google settings if not enabled
    Less secure apps & your Google Account - Google Account Help
  4. If you use MFA (2-step verification), use App password instead of normal password
    Sign in with App Passwords - Google Account Help

can you also guide me to configure the streams, alert and notification to get mail from graylog.

Don’t forget to also change Sender (optional) field in alert notification settings to real email address.
Still I don’t know where you have a problem, where include error message.

graylog not responded.


If this is NOT a production server, instead of using Google have you tried to use “sendmail” or postfix on you graylog server instead of Google.

For example to simplify things I installed “sendmail”. Simple instructions to follow.

After Sendmail was started and enabled on my server I configured my Graylog Server config like this.

transport_email_enabled = true
transport_email_hostname = localhost
tansport_email_port = 25
transport_email_subject_prefix = [graylog]
transport_email_from_email =
transport_email_web_interface_url = 

Last I configured my firewall to all mail port through

sudo ufw allow 25/tcp

Once your able to send mail you can fine tune your configuration to a more secure settings.

I assume your Graylog server will not start? If so, show us you configurations you made so we could identify any misconfigurations in your Graylog config file. If your having issues, showing your Log files would be appreciated.

If this is not the route you prefer then I would highly suggest you look over the links provided by @shoothub again. I believe you may have missed something.

Firewall is already disabled.


To be honest that really doesn’t help troubleshoot your issue.

Might find your answer here.

Hope that helps

Thanks for help
I got mail but also get a eroor like this—
(javax.mail.internet.AddressException: Missing final ‘@domain’ in string ``“”’’)


These may solve you issue.

Thanks for guidance
There is one doubt that what will be the effect if we use DEFLATE in elastic search at the place of LZ4. Is there any disadvantage rather than time?


I found these, they might help.

Here is a description of the two.

Deflate Defined

LZ4 Defined

I personal have not tried switching the data compression algorithm in elasticsearch.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.