# Email Alert sending separate emails for different messages
**URL:** https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577
**Category:** Graylog Central (peer support)
**Created:** [July 29, 2020, 8:25am UTC](https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577 "2020-07-29T08:25:28Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@peaky10](https://community.graylog.org/u/peaky10)
#### Post date: [July 29, 2020, 8:25am UTC](https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577/1 "2020-07-29T08:25:28Z")
_Using the Graylog version: 3.3.2_
I am using the below template for Graylog alerts and have not been receiving emails as expected.
```
--- [Event Definition] ---------------------------
Title: ${event_definition_title}
Description: ${event_definition_description}
Type: ${event_definition_type}
--- [Messages] -----------------------------------
${if backlog} ${foreach backlog message}
Response Code: ${message.fields.response_code} | HTTP_REFERRER: ${message.fields.http_referrer}
${end}${else}No Backlog${end}
--- [Event] --------------------------------------
Timestamp: ${event.timestamp}
Message: ${event.message}
Source: ${event.source}
--------------------------------------------------
```
While receiving email, I’m getting separate email for every message in backlog as below:
**First Email:**
```
--- [Event Definition] ---------------------------
Title: http referrer
Description: Http referrer with status code !=200
Type: aggregation-v1
--- [Messages] -----------------------------------
Response Code: 404 | HTTP_REFERRER: https://xxxx.xxx.xxxx/xxx
--- [Event] --------------------------------------
Timestamp: 2020-07-28T08:31:48.859Z
Message: http referrer
Source: e9ac8be01bcb
--------------------------------------------------
```
**Second Email:**
```
--- [Event Definition] ---------------------------
Title: http referrer
Description: Http referrer with status code !=200
Type: aggregation-v1
--- [Messages] -----------------------------------
Response Code: 502 | HTTP_REFERRER: https://xxxxx.xxxx/xxxx
--- [Event] --------------------------------------
Timestamp: 2020-07-28T09:01:05.465Z
Message: http referrer
Source: e9ac8be01bcb
--------------------------------------------------
```
**Third Email:**
```
--- [Event Definition] ---------------------------
Title: http referrer
Description: Http referrer with status code !=200
Type: aggregation-v1
--- [Messages] -----------------------------------
Response Code: 404 | HTTP_REFERRER: https://xxx.xxx.xxx.xxx/xxx
--- [Event] --------------------------------------
Timestamp: 2020-07-28T09:41:17.301Z
Message: http referrer
Source: e9ac8be01bcb
--------------------------------------------------
```
and so on.
I have been getting thousands of emails like this below:
I want to get all the backlog messages in a single email body, like below:
```
--- [Event Definition] ---------------------------
Title: http referrer
Description: Http referrer with status code !=200
Type: aggregation-v1
--- [Messages] -----------------------------------
Response Code: 404 | HTTP_REFERRER: https://xxxx.xxx.xxxx/xxx
Response Code: 502 | HTTP_REFERRER: https://xxxxx.xxxx/xxxx
Response Code: 404 | HTTP_REFERRER: https://xxx.xxx.xxx.xxx/xxx
--- [Event] --------------------------------------
Timestamp: 2020-07-28T08:31:48.859Z
Message: http referrer
Source: e9ac8be01bcb
--------------------------------------------------
```
Kindly guide me with the solution. Thanks!
---
### Author:  [@jan](https://community.graylog.org/u/jan)
#### Post date: [July 29, 2020, 9:55am UTC](https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577/2 "2020-07-29T09:55:06Z")
how did you configure the events and alerst?
---
### Author:  [@peaky10](https://community.graylog.org/u/peaky10)
#### Post date: [July 29, 2020, 10:23am UTC](https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577/3 "2020-07-29T10:23:13Z")
Took the screenshot of Summary:
I hope it helps in understanding the problem.
---
### Author:  [@peaky10](https://community.graylog.org/u/peaky10)
#### Post date: [August 5, 2020, 10:39am UTC](https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577/4 "2020-08-05T10:39:01Z")
Hello @jan,
Please help anything I can try to make this work?
Thanks!
---
### Author:  [@marick](https://community.graylog.org/u/marick)
#### Post date: [August 13, 2020, 8:10am UTC](https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577/5 "2020-08-13T08:10:17Z")
> [@peaky10](#):
>
> s below:
Guys thank you for great job!
I have the same problem. One email for every message.
Graylog server 3.3.3
elasticsearch 6.8.11
Oracle linux 7.8
---
### Author:  [@marick](https://community.graylog.org/u/marick)
#### Post date: [August 19, 2020, 11:46am UTC](https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577/6 "2020-08-19T11:46:35Z")
How many Events will Filter & Aggregation create?
The Filter & Aggregation Condition will generate different number of Events, depending on how it is configured:
- **Filter:** One Event per message matching the filter
- **Aggregation without groups:** One Event every time the aggregation result satisfies the condition
- **Aggregation with groups:** One Event per group whose aggregation result satisfies the condition
So I grouped by field ( beats\_type): Example: count(beats\_type) **\>** 1
If I group by **message** I get the following error:
“Fielddata is disabled on text fields by default. Set fielddata=true on [full\_message] in order to load fielddata in memory by uninverting the inverted index. Note
that this can however use significant memory. Alternatively use a keyword field instead., errorDetails=[Fielddata is disabled on text fields by default. Set fiel
ddata=true on [full\_message] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternativ
ely use a keyword field instead.]}
at org.graylog2.indexer.cluster.jest.JestUtils.specificException(JestUtils.java:110)
at org.graylog.plugins.views.search.elasticsearch.ElasticsearchBackend.doRun(ElasticsearchBackend.java:263)
at org.graylog.plugins.views.search.elasticsearch.ElasticsearchBackend.doRun(ElasticsearchBackend.java:74)”
Now I receive 1 mail for 10 messages if they come in 5 seconds interval.
I hope I’m doing it correctly 🙂
Hope it helps! 🙂
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [September 2, 2020, 11:46am UTC](https://community.graylog.org/t/email-alert-sending-separate-emails-for-different-messages/16577/7 "2020-09-02T11:46:36Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.