Cribl Stream Email Notifications Fail to Send

Symptom

A notification configured to use the system_email target shows as triggered in the notification logs, but the email is never received by the intended recipients.

Environment

• Cribl Stream
• Notifications feature
• system_email notification target
• Self-managed deployment
• Version 4.17.1

Resolution

1. Run a search against internal logs to review system_email delivery failures.
   dataset="cribl_internal_logs" "system_email"
2. Review the log entries around the time the notification is triggered and look for failed to deliver message errors.
3. Check the error details for a syntax message such as Invalid or unexpected token.
4. Inspect the email body template for invalid syntax or malformed variable usage.
5. If a line break or similar text is being treated as a variable, correct the template formatting and save the notification.
6. Trigger the notification again and confirm that the email is now delivered successfully.

Cause

This issue occurs when the email body contains invalid template syntax. In this case, a line break in the body was being treated as a variable, which caused the system_email delivery to fail with an Invalid or unexpected token error.

Last Validated

Cribl Stream 4.17.1

Additional Information

If you need to troubleshoot similar issues, internal notification errors can be reviewed in Cribl Search by querying the cribl_internal_logs dataset for system_email entries.