# Group by message data

**URL:** <https://community.graylog.org/t/group-by-message-data/13583>\
**Category:** Graylog Central (peer support)\
**Created:** [January 23, 2020, 7:46am UTC](https://community.graylog.org/t/group-by-message-data/13583 "2020-01-23T07:46:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![getaffe](https://avatars.discourse-cdn.com/v4/letter/g/f14d63/32.png) [@getaffe](https://community.graylog.org/u/getaffe)\
**Post date:** [January 23, 2020, 7:46am UTC](https://community.graylog.org/t/group-by-message-data/13583/1 "2020-01-23T07:46:36Z")

</div>

Hi all,

I have created a stream which store all error and exceptions comes fromsyslog. I want to group by errors according to error message

for example ı got this error 5 times in last 1 minutes. I want to group same type errors and create alert

how can ı do that ?

message  
/home/logs/app.log,07:14:09,534 INFO - DeviceCmd::writeException::handled::appKey::xxx::iid::gT07Jklck::deviceId::8f2ecac6

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [January 23, 2020, 3:55pm UTC](https://community.graylog.org/t/group-by-message-data/13583/2 "2020-01-23T15:55:18Z")

</div>

He @getaffe  
as you did not share your Graylog version I assume you have the latest running. What you want to make is an aggregation on the message, that is part of the enterprise plugins for alerting.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 6, 2020, 3:55pm UTC](https://community.graylog.org/t/group-by-message-data/13583/3 "2020-02-06T15:55:20Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.