# Aggregating Events for Notification

**URL:** <https://community.graylog.org/t/aggregating-events-for-notification/19170>\
**Category:** Graylog Central (peer support)\
**Created:** [March 18, 2021, 7:26pm UTC](https://community.graylog.org/t/aggregating-events-for-notification/19170 "2021-03-18T19:26:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Slair](https://avatars.discourse-cdn.com/v4/letter/s/278dde/32.png) [@Slair](https://community.graylog.org/u/Slair)\
**Post date:** [March 18, 2021, 7:26pm UTC](https://community.graylog.org/t/aggregating-events-for-notification/19170/1 "2021-03-18T19:26:45Z")

</div>

Hello, I am try to send email alerts when a Stream has events. I want to check the stream every 10 minutes, and if there were any events at all during the last 10 minutes, then send an email with a list of those events. From the settings shown below, I thought I had it setup correctly, however it is not working as intended. Whenever there is an Event (even milliseconds apart), it generates a notification for every event. I want it to only generate a notification up to every 10 minutes, and that notification should show any events that have occurred during the last 10 minutes. Would really appreciate some help on this!

Shows searching within last 10 minutes and executing search every 10 minutes:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/63b100b3c5c4b506857331171084d8869b753580.png)

I’d show the Notification, but as a new user I can only post messages with 1 picture. I have this in the Notification Body Template:

> ${if backlog}${foreach backlog message}${message.source}: ${message.timestamp} ${message.message}${end}${end}

---

<div class="post-metadata">

**Author:** ![Slair](https://avatars.discourse-cdn.com/v4/letter/s/278dde/32.png) [@Slair](https://community.graylog.org/u/Slair)\
**Post date:** [March 18, 2021, 8:01pm UTC](https://community.graylog.org/t/aggregating-events-for-notification/19170/2 "2021-03-18T20:01:42Z")

</div>

I was able to find the issue. For anyone else looking to do something similar, don’t forget to setup the Aggregation configuration:

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/8/8de587e5a319bcec8461eca0cdba9fb65a28099d.png)

---

<div class="post-metadata">

**Author:** ![ttsandrew](https://avatars.discourse-cdn.com/v4/letter/t/97f17d/32.png) [@ttsandrew](https://community.graylog.org/u/ttsandrew)\
**Post date:** [March 18, 2021, 8:32pm UTC](https://community.graylog.org/t/aggregating-events-for-notification/19170/3 "2021-03-18T20:32:30Z")

</div>

Hello Slair, welcome to the community! Thanks for sharing your solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [April 1, 2021, 8:33pm UTC](https://community.graylog.org/t/aggregating-events-for-notification/19170/4 "2021-04-01T20:33:29Z")

</div>

Closed on April 1, 2021, 8:33pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.