# Aggregate the same alerts into one mail

**URL:** <https://community.graylog.org/t/aggregate-the-same-alerts-into-one-mail/23995>\
**Category:** Graylog Central (peer support)\
**Created:** [May 25, 2022, 3:36am UTC](https://community.graylog.org/t/aggregate-the-same-alerts-into-one-mail/23995 "2022-05-25T03:36:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ericwu](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ericwu/32/11131_2.png) [@ericwu](https://community.graylog.org/u/ericwu)\
**Post date:** [May 25, 2022, 3:36am UTC](https://community.graylog.org/t/aggregate-the-same-alerts-into-one-mail/23995/1 "2022-05-25T03:36:26Z")

</div>

Hi All,

Our developer team setting the application retry time = 0  
That’s means if the error occur, we will receive so many alert mail.  
Are there any function can do the aggregate to one mail or filter the same alert?

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [May 25, 2022, 3:55am UTC](https://community.graylog.org/t/aggregate-the-same-alerts-into-one-mail/23995/2 "2022-05-25T03:55:43Z")

</div>

Hello,

Yes, but this depends on the configuration in the Event Definitions and the notification section.  
For example under Filter & Aggregation section it depends on how these are set as follow:

_Search within the last_  
Then  
_Execute search every_

That is tide into the Notification section under **Notification Settings**  
You have a Grace Period.

Example  
Search a specific stream with the **Search within the last: 30** minutes and execute **Execute search every: 30** minutes.

So it search the past 30 minutes and it executes every 30 minutes. There is the notification settings with Grace Period, once the alert goes off and sends email it will wait a specific amount of time to send another alert.

Then you have **Aggregation** section which will fine tune this events. For example `count() > 0`  
Which states if there is more then 0 messages in this stream , alert. this can be arise to a higher level if preferred

Under the Aggregation settings it can “_Summarize log messages matching the Filter defined by using a function. You can optionally group the Filter results by identical field values._” such as Source field or another unique field/s.

> [@ericwu](#):
>
> Our developer team setting the application retry time = 0

Not sure what setting that is, but I would suggest looking into Event Definition [here](https://docs.graylog.org/docs/alerts)

With the enterprise version you do have CORRELATION ENGINE as shown [here](https://docs.graylog.org/docs/correlation-engine), if you keep the amount under 2 Gb a day, its free.

hope that helps

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 8, 2022, 3:56am UTC](https://community.graylog.org/t/aggregate-the-same-alerts-into-one-mail/23995/3 "2022-06-08T03:56:40Z")

</div>

Closed on June 8, 2022, 3:56am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.