Email connector and action

The email connector uses the SMTP protocol to send mail messages, using an integration of Nodemailer. An exception is Microsoft Exchange, which uses HTTP protocol for sending emails, Send mail. Email message text is sent as both plain text and html text.

You can create connectors in Stack Management > Connectors or as needed when you’re creating a rule. For example:

Email connectors have the following configuration properties:

If you are running Kibana on-prem, you can define connectors by adding xpack.actions.preconfigured settings to your kibana.yml file. For example:

xpack.actions.preconfigured:
  my-email:
    name: preconfigured-email-connector-type
    actionTypeId: .email
    config:
      service: other
      from: testsender@test.com
      host: validhostname
      port: 8080
      secure: false
    secrets:
      user: testuser
      password: passwordkeystorevalue

Config defines information for the connector type.

Secrets defines sensitive information for the connector type.

You can test connectors with the run connector API or as you’re creating or editing the connector in Kibana. For example:

Email actions have the following configuration properties.

Use the Action configuration settings to customize connector networking configurations, such as proxies, certificates, or TLS settings. You can set configurations that apply to all your connectors or use xpack.actions.customHostSettings to set per-host configurations.

The email connector can send email using many popular SMTP email services and the Microsoft Exchange Graph API.

For more information about configuring the email connector to work with different email systems, refer to:

For other email servers, you can check the list of well-known services that Nodemailer supports in the JSON file well-known/services.json. The properties of the objects in those files — host, port, and secure — correspond to the same email connector configuration properties. A missing secure property in the "well-known/services.json" file is considered false. Typically, port: 465 uses secure: true, and port: 25 and port: 587 use secure: false.

Use the preconfigured email connector (Elastic-Cloud-SMTP) to send emails from Elastic Cloud.

Use the following email connector configuration to send email from the Gmail SMTP service:

  config:
    service: gmail
    // `host`, `port` and `secure` have the following default values and do not need to set:
    // host: smtp.gmail.com
    // port: 465
    // secure: true
  secrets:
    user: <username>
    password: <password>

If you get an authentication error that indicates that you need to continue the sign-in process from a web browser when the action attempts to send email, you need to configure Gmail to allow less secure apps to access your account.

If two-step verification is enabled for your account, you must generate and use a unique App Password to send email from Kibana. See Sign in using App Passwords for more information.

Use the following email connector configuration to send email from the Outlook.com SMTP service:

config:
    service: outlook365
    // `host`, `port` and `secure` have the following default values and do not need to set:
    // host: smtp.office365.com
    // port: 587
    // secure: false
secrets:
    user: <email.address>
    password: <password>

When sending emails, you must provide a from address, either as the default in your connector configuration or as part of the email action in the rule.

Use the following email connector configuration to send email from the Amazon Simple Email Service (SES) SMTP service:

config:
    service: ses
    // `host`, `port` and `secure` have the following default values and do not need to set:
    // host: email-smtp.us-east-1.amazonaws.com 
    // port: 465
    // secure: true
secrets:
    user: <username>
    password: <password>

[This Microsoft Exchange configuration is deprecated in 7.16.0] Deprecated in This Microsoft Exchange configuration is deprecated in 7.16.0. and will be removed later :

config:
    service: other
    host: <your exchange server>
    port: 465
    secure: true
    from: <email address of service account> 
secrets:
    user: <email address of service account> 
    password: <password>

To prepare for the removal of Basic Auth, you must update all existing Microsoft Exchange connectors with the new configuration based on the OAuth 2.0 Client Credentials Authentication.

Before you create an email connector for Microsoft Exchange, you must create and register the client integration application on the Azure portal:

Next, open Manage > API permissions, and then define the permissions for the registered application to send emails. Refer to the documentation for the Microsoft Graph API.

Add the "Mail.Send" permission for Microsoft Graph. The permission appears in the list with the status "Not granted for <your Azure active directory>":

Click Grant admin consent for <your Azure active directory>.

Confirm that the status for the "Mail.Send" permission is now granted.

To configure the Client secret , open Manage > Certificates & secrets.

Add a new client secret, then copy the value and put it to the proper field in the Microsoft Exchange email connector.

To find the application Client ID, open the Overview page.

Copy and paste this values to the proper fields in the Microsoft Exchange email connector.

Use the following email connector configuration to send email from Microsoft Exchange:

config:
    service: exchange_server
    clientId: <The Application (client) ID> 
    tenantId: <The directory tenant ID, in GUID format.>
    from: <email address of service account> 
secrets:
    clientSecret: <URL-encoded string>