# Limit backlog to alerts matching grouping condition

**URL:** <https://community.graylog.org/t/limit-backlog-to-alerts-matching-grouping-condition/11822>\
**Category:** Graylog Central (peer support)\
**Created:** [September 3, 2019, 8:21pm UTC](https://community.graylog.org/t/limit-backlog-to-alerts-matching-grouping-condition/11822 "2019-09-03T20:21:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![josha\_ml](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@josha\_ml](https://community.graylog.org/u/josha_ml)\
**Post date:** [September 3, 2019, 8:21pm UTC](https://community.graylog.org/t/limit-backlog-to-alerts-matching-grouping-condition/11822/1 "2019-09-03T20:21:46Z")

</div>

Hello,

The addition of the grouping to alert conditions in 3.1 is a huge help! The only thing I am wondering if I am missing or overlooking, is there a way to have the notification that gets sent for an alert event include the backlog of messages that only match the grouped key or filter?

Currently it seems to include all of the messages that match the given search filter, not just those that also matched the aggregation condition to trigger the alert.

Thanks!  
Josh

---

<div class="post-metadata">

**Author:** ![konrad](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/konrad/32/1661_2.png) [@konrad](https://community.graylog.org/u/konrad)\
**Post date:** [September 4, 2019, 7:44am UTC](https://community.graylog.org/t/limit-backlog-to-alerts-matching-grouping-condition/11822/2 "2019-09-04T07:44:46Z")

</div>

Hi @josha_ml,

No you are right. As it seems we do not separate the messages based on the grouping  
key for the message backlog.

Could you please open a feature request on [github](https://github.com/Graylog2/graylog2-server/issues/new) with a detailed example?

Thank you!

Cheers,  
Konrad

---

<div class="post-metadata">

**Author:** ![josha\_ml](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@josha\_ml](https://community.graylog.org/u/josha_ml)\
**Post date:** [September 4, 2019, 8:05am UTC](https://community.graylog.org/t/limit-backlog-to-alerts-matching-grouping-condition/11822/3 "2019-09-04T08:05:49Z")

</div>

Done! #6381

[https://github.com/Graylog2/graylog2-server/issues/6381](https://github.com/Graylog2/graylog2-server/issues/6381)

Thanks!

![image001.jpg](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/2485d26919316b1d80aa60f5ca8e2cb5bc0275fe.jpeg)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 18, 2019, 8:05am UTC](https://community.graylog.org/t/limit-backlog-to-alerts-matching-grouping-condition/11822/4 "2019-09-18T08:05:50Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.