Problem with multiple line into Alert

[MickGraylog1 (Mick)]

I received multiple mail with weird message into it.

Into my mail, I received the same message multiple time. Can I combine the sources in one message?
Can I get only one message from the source

I’ve create the Events for Definition with the different count.

Thank you

[m_mlk]

Hi @MickGraylog1

this is exactly the problem I described in my post:

[SOLVED] Event notifications not sending aggregated logs

1. Describe your incident: we have defined an alert based on an event. The filter we use yields several results and that is fine. The notification tab is configured to have a “Grace Period = 0” and “Message Backlog = 50” (at least for now). However, instead of getting 1 single email with a backlog of up to 50 error messages, I receive 1 email per message line… not cool. 2. Describe your environment: OS Information: Ubuntu 20.04 LTS Package Version: GL 4.3.9 + OpenSearch 1.3.3 Servi…

Hopefully someone will shed some light in this…

Cheers

[patrickmann]

You need to set up an aggregation.
Here’s a thread that looks like the same issue:

Aggregating Events for Notification

Hello, I am try to send email alerts when a Stream has events. I want to check the stream every 10 minutes, and if there were any events at all during the last 10 minutes, then send an email with a list of those events. From the settings shown below, I thought I had it setup correctly, however it is not working as intended. Whenever there is an Event (even milliseconds apart), it generates a notification for every event. I want it to only generate a notification up to every 10 minutes, and t…

[MickGraylog1 (Mick)]

Hello,

Thank you so much guys for your guide.

The solution was the aggregation :
if
count() - nothing in field - > 0

and it’s working perfectly, the only problem is I have duplicate source into the problem.
When I tried to add an if max source = 1, nothing happen else.

Thank you!