# Incoming e-mails

Create incidents automatically from **any tool that can send an e-mail**. The email integration allows you to parse custom data, set creation rules, and map fields to create detailed, actionable incidents.

## Getting started

1.  Go to **Integrations** → [Importing data](https://uptime.betterstack.com/team/0/integrations/importing-data ";_blank").
2.  Find the **E-mail** card and click **Add**.
3.  Give your integration a **Name** and click **Save changes**.
4.  Copy the unique **E-mail address**. This is the address your external service will send e-mails to.

## Configuring the integration

Once you have your e-mail address set up, you can configure how it processes incoming data to create, update, and resolve incidents.

### Incident creation rules

Define when an incident should be created. You can set up one or more conditions based on the **subject**, **sender address**, and **body** in your e-mail. If **ANY** or **ALL** of the conditions match—depending on your configuration—an incident will be created.

For example, you can create an incident when the subject in the e-mail contains the word `New alert`.

### Data extraction

Map data from the e-mail directly to Better Stack incident fields. This enriches your incidents with contextual information, making it easier to understand and debug issues.

You can extract data for the following fields:

*   **Title**: The main title of the incident.
*   **Cause**: A short description of what triggered the incident.
*   **Alert ID**: A unique identifier for the incdient, which can avoid duplicates.
*   **Metadata**: Any [metadata](https://betterstack.com/docs/uptime/incident-metadata/) can be extracted from the e-mail.

Extract values by matching text **before**, **after**, or **between** specific texts, or using **regular expressions**.

### Acknowledging and resolving incidents

Configure rules to automatically acknowledge or resolve incidents based on the incoming e-mail.

*   **Acknowledging incidents**: Set conditions to automatically acknowledge an incident. By default, this is set to **Never**, requiring manual acknowledgment.
*   **Resolving incidents**: Set conditions to automatically resolve an incident. For example, you can auto-resolve if the email subject contains the word `(Resolved)`. By default, this is set to **Never**, requiring manual resolution.

### On-call escalation

Define who gets notified when an incident is created. You can use a **simple escalation**, use one of your existing [escalation policies](https://betterstack.com/docs/uptime/escalation-policies/), or create a new one with specific steps, notification channels, and time-based rules.

### Advanced settings

*   **Recovery period**: Set a [recovery period](https://betterstack.com/docs/uptime/confirmation-and-recovery-period/) to define how long an alert must remain stable before being automatically marked as resolved. The default is **Immediate recovery**.
*   **Metadata**: Attach custom key-value pairs (for example, `datacenter: us-west-1`) to incidents. This metadata can be used for advanced filtering or routing rules in your escalation policies.

## Need help?

Please let us know at [hello@betterstack.com](mailto:hello@betterstack.com). We're happy to help. 🙏