# I want to inform you of the same message you received for one minute only once and include the number of times in the content

**URL:** <https://community.graylog.org/t/i-want-to-inform-you-of-the-same-message-you-received-for-one-minute-only-once-and-include-the-number-of-times-in-the-content/22875>\
**Category:** Graylog Central (peer support)\
**Tags:** alert\
**Created:** [March 7, 2022, 5:50am UTC](https://community.graylog.org/t/i-want-to-inform-you-of-the-same-message-you-received-for-one-minute-only-once-and-include-the-number-of-times-in-the-content/22875 "2022-03-07T05:50:43Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rockJ](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@rockJ](https://community.graylog.org/u/rockJ)\
**Post date:** [March 7, 2022, 5:50am UTC](https://community.graylog.org/t/i-want-to-inform-you-of-the-same-message-you-received-for-one-minute-only-once-and-include-the-number-of-times-in-the-content/22875/1 "2022-03-07T05:50:43Z")

</div>

Hello  
I’m a beginner using Graylog.  
I would like to ask for advice from many masters.

We are sending it to each person in charge by e-mail according to the alert rule.  
Sometimes there are logs that generate the same alert during the service, and in some cases, these logs generate dozens of logs per minute.  
The problem is that all alert mails generated in this way may be full of mailbox on the receiving side or may be recognized as attacks and blocked.  
You can also simply set it as _count()\>=20_ or the like in Aggregation settings.  
However, I would like to receive such a large amount of the same alert mail once a minute and record how many times it has occurred in total.  
For example, it’s as follows.  
Message A has been received. This message was generated once a minute.  
Message B has been received. This message was generated 30 times a minute.

I think there are some people who have the same concerns as me.  
Please let me know what your solution was.

Thank you in advance for your answers.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 8, 2022, 11:09pm UTC](https://community.graylog.org/t/i-want-to-inform-you-of-the-same-message-you-received-for-one-minute-only-once-and-include-the-number-of-times-in-the-content/22875/2 "2022-03-08T23:09:20Z")

</div>

Hello,

Maybe try something like this.

> [@rockJ](#):
>
> Message A has been received. This message was generated once a minute.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/ccf4e9b02b3cc233e12448ab26fb713a10ee2aa4.png)

> [@rockJ](#):
>
> Message B has been received. This message was generated 30 times a minute.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/6/6a001974cbd13f2e18d0b06b40eedd0345e8dfe7.png)

---

<div class="post-metadata">

**Author:** ![rockJ](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@rockJ](https://community.graylog.org/u/rockJ)\
**Post date:** [March 11, 2022, 1:58am UTC](https://community.graylog.org/t/i-want-to-inform-you-of-the-same-message-you-received-for-one-minute-only-once-and-include-the-number-of-times-in-the-content/22875/3 "2022-03-11T01:58:35Z")

</div>

Thanks so much for the reply gsmith.  
Haven’t been able to test it yet with other tasks.  
We will test it and let you know the confirmed result.

Have a nice day.

---

<div class="post-metadata">

**Author:** ![rockJ](https://avatars.discourse-cdn.com/v4/letter/r/ad7895/32.png) [@rockJ](https://community.graylog.org/u/rockJ)\
**Post date:** [March 14, 2022, 1:22am UTC](https://community.graylog.org/t/i-want-to-inform-you-of-the-same-message-you-received-for-one-minute-only-once-and-include-the-number-of-times-in-the-content/22875/4 "2022-03-14T01:22:50Z")

</div>

It worked fine the way you told me.  
thank you.  
Have a nice day.

---

<div class="post-metadata">

**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\
**Post date:** [March 14, 2022, 9:08pm UTC](https://community.graylog.org/t/i-want-to-inform-you-of-the-same-message-you-received-for-one-minute-only-once-and-include-the-number-of-times-in-the-content/22875/5 "2022-03-14T21:08:13Z")

</div>

Nice 👍 it worked out.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 28, 2022, 9:08pm UTC](https://community.graylog.org/t/i-want-to-inform-you-of-the-same-message-you-received-for-one-minute-only-once-and-include-the-number-of-times-in-the-content/22875/6 "2022-03-28T21:08:21Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
