# Notifications being sent too frequently **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [January 13, 2020, 7:58pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452 "2020-01-13T19:58:40Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![kcbaltz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/kcbaltz/32/5590_2.png) [@kcbaltz](https://community.graylog.org/u/kcbaltz)\ **Post date:** [January 13, 2020, 7:58pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/1 "2020-01-13T19:58:41Z")
I’m evaluating alerting and setup a test Event and Notification. My event is supposed to run every minute and look at the last minute. I setup a Notification for this event to email my when it’s triggered. My event happens frequently (which is good for testing purposes) but I found I was getting multiple emails per minute. My expectation is that if the query is run once a minute, I should get at most one email per minute. Am I mistaken? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 13, 2020, 9:08pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/2 "2020-01-13T21:08:13Z")
he @kcbaltz what Graylog version did you run? ---
**Author:** ![kcbaltz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/kcbaltz/32/5590_2.png) [@kcbaltz](https://community.graylog.org/u/kcbaltz)\ **Post date:** [January 14, 2020, 4:55pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/3 "2020-01-14T16:55:24Z")
We’re running 3.1.3. I’m wondering if I have the wrong expectation. It seems like maybe GL is sending an email per log event that matches the filter rather than sending a single email with all the matching events from that period. If that’s what’s supposed to happen, how can I aggregate the results to send all the results (or the first 20 ) in a single email? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 14, 2020, 7:46pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/4 "2020-01-14T19:46:21Z")
it actually depends @kcbaltz on your configuration. So how you made the settings for that. ---
**Author:** ![kcbaltz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/kcbaltz/32/5590_2.png) [@kcbaltz](https://community.graylog.org/u/kcbaltz)\ **Post date:** [January 15, 2020, 8:05pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/5 "2020-01-15T20:05:51Z")
I’m not sure what you’re asking/telling me. If an Event configuration is setup to run every 5 minutes, and search the last five minutes, it appears that every matching log line for the filter results in an Event and each Event results in a Notification such that 50 Events in 5 minutes cause 50 emails. Is there a way to group those together into a single “event/notification” without aggregating the results. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 16, 2020, 1:14pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/6 "2020-01-16T13:14:34Z")
he @kcbaltz now it makes more sense - you would use aggregations for that. So you aggregate over the last 5 minutes searching the last 5 minutes. ---
**Author:** ![kcbaltz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/kcbaltz/32/5590_2.png) [@kcbaltz](https://community.graylog.org/u/kcbaltz)\ **Post date:** [January 16, 2020, 3:22pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/7 "2020-01-16T15:22:56Z")
But if I aggregate (E.g. count the number of errors), won’t I lose the detail of which events happened? In other words, if there were 7 Login Failures, I want to see the 7 usernames in the notification, not just the number “7” as the count. ---
**Author:** ![kcbaltz](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/kcbaltz/32/5590_2.png) [@kcbaltz](https://community.graylog.org/u/kcbaltz)\ **Post date:** [January 16, 2020, 6:48pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/8 "2020-01-16T18:48:22Z")
Also, assuming I’m willing to live without having the individual log messages in the notification, I’d still like some way to only receive 1 notification per 5 minute period regardless how many messages matched. I tried adding an Aggregation that says count() \> 0 but that still appeared to generate multiple Events. ---
**Author:** ![Spoth](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/spoth/32/5603_2.png) [@Spoth](https://community.graylog.org/u/Spoth)\ **Post date:** [January 16, 2020, 8:11pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/9 "2020-01-16T20:11:50Z")
Hi, I’m seeing the same behavior and I don’t understand the discussion here. In the tab to configure the notification, it says for the “Grace Period”: “Set a Grace Period to control how long Graylog should wait before sending Notifications again.”. So when I set this to 1 I would totally expect this notification to be sent maximum once a minute. So what else does this mean if not that? Regards, Sven ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [January 17, 2020, 4:49pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/10 "2020-01-17T16:49:51Z")
@kcbaltz you do not loose the details - as you can select on what field you want to aggregate and what details you want to retain in that aggregated message. Means you can decide what information should be available. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [January 31, 2020, 5:00pm UTC](https://community.graylog.org/t/notifications-being-sent-too-frequently/13452/11 "2020-01-31T17:00:46Z")
Closed on January 31, 2020, 5:00pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.