I set up an event such way:
I use graylog to collect logs from network equipment. And want to get e-mail every 10 minutes with new errors in logs (All messages).
My logs (be careful with timestamps):
So i expected to get today an email with the error in about 10:40. I got this email, but with another old error: