title: Not getting each error email alert from logstash 1.5.4
body: <p>I have my ELK setup like below:</p>
  
  <p><strong>HOST1:</strong> Component(which generates log) + Logstash (To send logs to redis)</p>
  
  <p><strong>HOST2:</strong> Redis + Elasticsearch + Logstash ( To parse data based on grok and send it to elasticsearch on same setup)</p>
  
  <p><strong>HOST3:</strong> Redis + Elasticsearch + Logstash ( To parse data based on grok and send it to elasticsearch on same setup)</p>
  
  <p><strong>HOST4:</strong> nginx + Kibana 4</p>
  
  <p>Now when I send one error log line from logstash to redis, I get double entry in Kibana 4. Like below:</p>
  
  <p><a href="https://i.stack.imgur.com/zIaC9.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zIaC9.jpg" alt="enter image description here"></a></p>
  
  <p>Plus I didnt get any email alert from logstash, although it is configured to send alert when <strong>severity == "Erro"</strong>.</p>
  
  <p>this is part of logstash conf file:</p>
  
  <pre><code>output {
  elasticsearch { host =&gt; ["&lt;ELK IP&gt;"]  port =&gt; "9200" protocol =&gt; "http" }
  if [severity] =~ /Erro/
  {
  email {
          from =&gt; "someone@somedomain.com"
          subject =&gt; "Error Alert"
          to =&gt; "someone@somedomain.com"
          via =&gt; "smtp"
          htmlbody =&gt; "&lt;h2&gt;Error Alert1&lt;/h2&gt;&lt;br/&gt;&lt;br/&gt;&lt;div
          align='center'&gt;%{message}&lt;/div&gt;"
          options =&gt; [
                 "smtpIporHost", "smtp.office365.com",
                 "port", "587",
                 "domain", "smtp.office365.com",
                 "userName", "someone@somedomain.com",
                 "password", "somepasswd",
                 "authenticationType", "login",
                 "starttls", "true"
         ]
  }
  }
  stdout { codec =&gt; rubydebug }
  }
  </code></pre>
  
  <p>I am using following custom grok pattern to parse log line:</p>
  
  <pre><code>ABTIMESTAMP %{YEAR}%{MONTHNUM2}%{MONTHDAY} %{USERNAME}
  ABLOGLEVEL (Note|Erro|Fatl|Warn|Urgt)
  ABLOG %{ABTIMESTAMP:timestamp} %{HOST:hostname} %{WORD:servername} %{INT:pid} %{INT:lwp} %{INT:thread} %{ABLOGLEVEL:severity};%{USERNAME:event}\(%{NUMBER:msgcat}/%{NUMBER:msgnum}\)%{GREEDYDATA:greedydata}
  </code></pre>
  
  <p>Any help here as, how to get each email alert for every error log line?</p>
  
  <p>Thanks in advance!</p>