You configure the accounts Watcher can use to send email in your elasticsearch.yml configuration file. Each account configuration has a unique name and specifies all of the SMTP information needed to send email from that account. You can also specify defaults for all emails that are sent through the account. For example, you can set defaults for the from and bcc fields to ensure that all emails are sent from the same address and always blind copied to the same address.

If you configure multiple email accounts, you specify which account the email should be sent with in the email action. If there is only one account configured, you do not have to specify the account attribute in the action definition. However, if you configure multiple accounts and omit the account attribute, there is no guarantee which account will be used to send the email.

To add an email account, set the watcher.actions.email.service.account property in elasticsearch.yml. See Email Account Attributes for the supported attributes.

For example, the following snippet configures a single Gmail account named work.

watcher.actions.email.service.account:
    work:
        profile: gmail
        email_defaults:
            from: 'John Doe <john.doe@host.domain>'
            bcc: archive@host.domain
        smtp:
            auth: true
            starttls.enable: true
            host: smtp.gmail.com
            port: 587
            user: <username>
            password: <password>

The email profile defines a strategy for building a MIME message. As with almost every standard out there, different email systems interpret the MIME standard differently and have slightly different ways of structuring MIME messages. Watcher provides three email profiles: standard (default), gmail, and outlook.

If you are using Gmail or Outlook, we recommend using the corresponding profile. Use the standard profile if you are using some other email system. For more information about configuring Watcher to work with different email systems, see:

watcher.actions.email.service.account:
    gmail_account:
        profile: gmail
        smtp:
            auth: true
            starttls.enable: true
            host: smtp.gmail.com
            port: 587
            user: <username>
            password: <password>

watcher.actions.email.service.account:
    outlook_account:
        profile: outlook
        smtp:
            auth: true
            starttls.enable: true
            host: smtp-mail.outlook.com
            port: 587
            user: <username>
            password: <password>

watcher.actions.email.service.account:
    ses_account:
        smtp:
            auth: true
            starttls.enable: true
            starttls.required: true
            host: email-smtp.us-east-1.amazonaws.com 
            port: 587
            user: <username>
            password: <password>

watcher.actions.email.service.account:
    exchange_account:
        profile: outlook
        email_defaults:
            from: <email address of service account> 
        smtp:
            auth: true
            starttls.enable: true
            host: <your exchange server>
            port: 587
            user: <email address of service account> 
            password: <password>

The email action supports sending messages with an HTML body. However, for security reasons, Watcher sanitizes the HTML.

You can control which HTML features are allowed or disallowed by configuring the watcher.actions.email.html.sanitization.allow and watcher.actions.email.html.sanitization.disallow settings in elasticsearch.yml. You can specify individual HTML elements and the feature groups described in the following table. By default, Watcher allows the following features: body, head, _tables, _links, _blocks, _formatting and img:embedded.

For example, the following settings allow the HTML to contain tables and block elements, but disallow <h4>, <h5> and <h6> tags.

watcher.actions.email.html.sanitization:
    allow: _tables, _blocks
    disallow: h4, h5, h6

To disable sanitization entirely, add the following setting to elasticsearch.yml:

watcher.actions.email.html.sanitization.enabled: false