# Sending email alert automatically **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [May 2, 2019, 4:04pm UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229 "2019-05-02T16:04:26Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 2, 2019, 4:04pm UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/1 "2019-05-02T16:04:26Z")
Hello everyone, Please i would be grateful if someone help me in " email alert " in the case of email alert in graylog 2.5, why the email does not send automaticcally when the action is triggered ….I receive the email if I do a " test alert " ![test](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/349d00b391b13e17bb76bbabddc8fa84052df003.png) ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [May 2, 2019, 5:06pm UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/2 "2019-05-02T17:06:58Z")
You ask questions without offering background information. - What configuration do you have in your server.conf (located at /etc/graylog/server/ by default on my Ubuntu) file that is related to e-mail? (post it) - What is the configuration for the alert you are testing? (post it) - Have you tested to see if your e-mail server will send/receive e-mail coming from the Graylog server (Telnet from Graylog server to e-mail server port 25 and run commands to send a test e-mail) Whenever you post a question, you should say what you have looked and and tried, show what your current related configs are and post relevant log entries. ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 7:59am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/3 "2019-05-03T07:59:30Z")
in centos 7 /etc/graylog/server/server.conf ![ee](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5b2cbb08f106377086c714672154720d1466ede6.png) I want to be notified automatically with email when there is a connection ssh failed to my VM zabbix ![alert%20zabbix](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/84514b05cdf5365087e46f186bd8c9947e6f0d8b.png) ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 8:05am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/4 "2019-05-03T08:05:43Z")
![warning%20zabbix](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/69c888be0ff55b56128a98faa0333f81321c4d7a.png) ![logs%20za](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e1acab18254b5c35de977d458c26176b5d49b8af.png) ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 8:44am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/5 "2019-05-03T08:44:25Z")
can i use AlertManager > **[How do I get my Graylog alerts into Prometheus AlertManager?](https://www.gdatasoftware.com/blog/2019/04/31542-howto-combine-graylog-alertmanager)** > > This short hands-on example will show you how to connect your Graylog-alerting with your AlertManager by using a Graylog notification callback plugin. ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [May 3, 2019, 8:51am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/6 "2019-05-03T08:51:50Z")
Have you configured an alert condition or just the alert notification? If you haven’t configured the alert condition, you won’t get an email because there is no alert being triggered. ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 8:56am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/7 "2019-05-03T08:56:59Z")
Hi @Ponet Yes, you’re right , check with me please if i well configured the alert condition ![alert%20condition](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5f7f3c9304c57413c4683f12c03043852dc55dae.png) ![0](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/316044ac117d077ab2c613715f113931c4114d4e.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [May 3, 2019, 9:01am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/8 "2019-05-03T09:01:05Z")
Are you sure that the failed authentication messages are being routed into the “alert zabbix” stream? The example message screenshot you posted in an earlier reply only appears to be in the “All Messages” stream. ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 9:04am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/9 "2019-05-03T09:04:41Z")
![stream%20za](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/06594cfaef24e86f0d198488afe869f941730486.png) ![rule%20zabbix](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/0/0ee8420a90afe43322b72689d3820329fbc983f6.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [May 3, 2019, 9:06am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/10 "2019-05-03T09:06:40Z")
In your example message, the field `full_message` doesn’t exist. Try with the field set to `message`. ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 9:12am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/11 "2019-05-03T09:12:52Z")
![index%20copy](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/de9daeece6dcedad385ca83d21f94cab6abe8186.png) ![load%20msg](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/5/5ac7237569e11774a5af000bd44f223df0c602c2.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [May 3, 2019, 9:16am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/12 "2019-05-03T09:16:52Z")
Yes… Notice the message in the second section “This message would not be routed to this stream.” You need to update the stream rule. It is looking for “Failed password” in the field `full_message`. It isn’t going to match on your desired message because it doesn’t have a `full_message` field. Update your stream rule to check the `message` field for the value “Failed password”. ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 9:23am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/13 "2019-05-03T09:23:55Z")
![lo](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/1b2fc486cdd1e8fdb069b80de1f3147c0fd45000.png) Could you expand a bit on that? ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [May 3, 2019, 9:28am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/14 "2019-05-03T09:28:46Z")
Look at the actual rule. "Field `full_message` must contain `Failed password`". When that rule tests against your message, it evaluates to false because the message does not contain the field `full_message`. This means the message will not be routed into the stream. Update that rule so that it is checking the `message` field. Your rule should then say: "Field `message` must contain `Failed password`" ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/cc9764ef4fabc6dcbfe072d89bc6d5c5e9a74e65.png) ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 9:36am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/15 "2019-05-03T09:36:07Z")
so, please I have to edit there ?? ![modi](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/35093b598b96be290e4f1c6ae1d85abbd4ab3e7e.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [May 3, 2019, 9:38am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/16 "2019-05-03T09:38:17Z")
Yes. Change the ‘Field’ value from `full_message` to `message`. ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 9:40am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/17 "2019-05-03T09:40:11Z")
??? ![fullll](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/27b53ea8f0a3abd053edc6e9e5b29014fa8133a7.png) ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [May 3, 2019, 9:42am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/18 "2019-05-03T09:42:21Z")
No. Please re-read what I wrote. This is very simple. I cannot explain any better than I already have. ---
**Author:** ![Labidi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/labidi/32/5597_2.png) [@Labidi](https://community.graylog.org/u/Labidi)\ **Post date:** [May 3, 2019, 9:45am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/19 "2019-05-03T09:45:12Z")
sorry bro ! I change the field " Value " ?? ---
**Author:** ![Ponet](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ponet/32/2131_2.png) [@Ponet](https://community.graylog.org/u/Ponet)\ **Post date:** [May 3, 2019, 9:47am UTC](https://community.graylog.org/t/sending-email-alert-automatically/10229/20 "2019-05-03T09:47:09Z")
Change the ‘Field’ value from `full_message` to `message` . ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/dceb900852024e6ec34d0be34a42ea42e5a1e1b3.png) [Next page](https://community.graylog.org/t/sending-email-alert-automatically/10229.md?page=2)