# Reduce email notification if same/similar message **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** alert\ **Created:** [March 9, 2023, 10:22am UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018 "2023-03-09T10:22:03Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![minouch](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/minouch/32/10876_2.png) [@minouch](https://community.graylog.org/u/minouch)\ **Post date:** [March 9, 2023, 10:22am UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/1 "2023-03-09T10:22:03Z")
Hi dear community. I’m configuring email notifications in graylog to receive level 0 and 1 alerts for my cisco switchs. this is working fine. but it happens quite often that a same message is triggered several time a day which is generating many useless emails. I would like if possible to only receive one email for a specific message per day. for instance : these are emails i’m receiving : ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/ac99a62fbb09501c40c733db5d17401cdfd5423a.png) messages with red rectangle are sent many times a day but it’s exactly the same information. I would like to only have 1 message and skip the next ones until the next day or next week for instance. is that possible please? Thank you for your help. //minouch ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [March 9, 2023, 10:38pm UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/2 "2023-03-09T22:38:53Z")
Hey @minouch > [@minouch](#): > > I would like if possible to only receive one email for a specific message per day. When creating the Event Definition there are settings under Notification that can make it happen. There called Grace Period and Message Backlog. This ties into your **Search within the last** && **Execute search every** which is under filter & Aggregation. ---
**Author:** ![minouch](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/minouch/32/10876_2.png) [@minouch](https://community.graylog.org/u/minouch)\ **Post date:** [March 13, 2023, 2:02pm UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/3 "2023-03-13T14:02:42Z")
Hi Gsmith, thank you for your reply. so in my “Filter & Aggregation” tab i have set it this way : ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/d598f2e7c3ca7318efb81e0c92440a0bfe1e87ed.png) then on the Notifications tab, I have appliled a 24h Grace period : ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/24ae13d820c52996f5d3edf7be8f725e31bdbf95.png) so if I understand it correctly, each individual alert message will be sent only once per 24h ? regarding the message backlog, should I let it unticked ? I’m not sure to understand the behaviour of message backlog actually, if I tick it and put “1” for instance, does that mean I will only receive 1 alert message from Graylog in 24h ? or does that mean 1 message maximum per different alert in 24h ? Thank you for your help 🙂 //Minouch ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [March 13, 2023, 9:18pm UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/4 "2023-03-13T21:18:35Z")
hey @minouch > [@minouch](#): > > I’m not sure to understand the behaviour Like it states **“Number of messages to be inclued in the notifications”**. If you do not want a message to be included in alert then you all good, If you want a message or messages then tick the box and you can add how many messages you would like per email. ---
**Author:** ![minouch](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/minouch/32/10876_2.png) [@minouch](https://community.graylog.org/u/minouch)\ **Post date:** [March 14, 2023, 11:30am UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/5 "2023-03-14T11:30:24Z")
Hi Gsmith. I have put 1 in messages as it was before but keeping 24 hours as grace period doesn’t work I think because I only receive one notification in 24hours which is not what I want. I would like each notifications to be received once/24h. so as an example if I receive 2 different messages, I will receive them both but the next same message i’m receiving I will only receive them 24h after. My english is not perfect, so I’m not sure if i’m clear enough 🙂 please if i’m not clear, let me know i’ll try to show with pictures. maybe solution is to play with “keys” here. thank you. //minouch ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [March 14, 2023, 9:51pm UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/6 "2023-03-14T21:51:39Z")
Hello @minouch Ok i understand now. You may need to configure _Create Events for Definition if._. This is under “Filter & Aggregation”. If you have multiple message coming in within 24 hours but only want one in a 24 hours then perhaps Using “Group by Field/s” then below that setting configure _Create Events for Definition_ Something like this: ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/2/29efe9b3420d974114a95da74c54882009023a80.png) This states if the count is greater the 0 send alert. All the steps. - **Search within the last** 1 minute ( this will search back intime for 1 minute) - **Execute search every** 1 minute (this will execute every minute to search back intime for 1 minute) - **Group by fields** “source” - **Events for Definition** if Count() is greater \> then 0 then alert. - **Notification setting** grace priod 24 hour (wait 24 hours to send another alert) - [Alerts and Events](https://go2docs.graylog.org/5-0/interacting_with_your_log_data/alerts_and_events.html?tocpath=Interacting%20with%20Your%20Log%20Data%7CAlerts%20and%20Notifications%7CAlerts%20and%20Events%7C _____ 0) ---
**Author:** ![minouch](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/minouch/32/10876_2.png) [@minouch](https://community.graylog.org/u/minouch)\ **Post date:** [March 27, 2023, 8:56am UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/7 "2023-03-27T08:56:23Z")
Thank you Gsmith for your answer and apologise for the delay, I was travelling and couldn’t test it. I just applied settings as you described : ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/321798d1278fe835eefc0a5c683bf07a61565d1d.png) I will monitore it on the incoming days if it works. Thank you ---
**Author:** ![minouch](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/minouch/32/10876_2.png) [@minouch](https://community.graylog.org/u/minouch)\ **Post date:** [March 27, 2023, 9:16am UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/8 "2023-03-27T09:16:34Z")
Another question actually, in my case, shouldn’t I use “Message - String” instead of “source - string” ? cause the way I understand it, it’s based on source name or IP so I could miss some messages if another event is triggered with same IP ? ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [March 27, 2023, 9:07pm UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/9 "2023-03-27T21:07:11Z")
> [@minouch](#): > > Message - String” instead of “source - string Message-String is the message field, most do dont if you st count how many message you have. I probably could come up with another suggestion if you could post what you trying to achieve. ---
**Author:** ![minouch](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/minouch/32/10876_2.png) [@minouch](https://community.graylog.org/u/minouch)\ **Post date:** [March 28, 2023, 3:31pm UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/10 "2023-03-28T15:31:22Z")
Hi Gsmith, I’m afraid it’s not working properly. I only received one email today from graylog matching the requirements : ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/d/df5e2797256faa5c7f6bb84da21dea439c10f400.png) but on graylog side, I received 9 messages in total (matching the same requirements) but only 4 different messages (see colors red green yellow and blue below) ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/9/99bbf8ec4232d22d4c17e80420b6ef8cb42e5dbf.png) idealy what i’m trying to achieve is to only receive one message per color and per day. so most likely in this situation i would have received only 4 emails. but in my case with settings you suggested me, I only received one email which is the top one in the list with blue rectangle. Thank you. ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [March 28, 2023, 10:03pm UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/11 "2023-03-28T22:03:28Z")
Hey @minouch > [@minouch](#): > > received only 4 emails Easiest way I know of is if you want 4 emails per “color”, then I would suggest filter them out into different streams /w rules. **Example** : ```auto Stream: Standby 1 stack-manager( blue) Stream: Switch 2 Hotspot (Yellow) Stream: Link Changed 3 stack-manager (green) Stream: Switch 5 Hotspot (Red) ``` Or However you want to separted them, either by device, events, warnings, errors, etc… Create Event Definition for each one of the streams, then attach a common Notification to each on the the Event Definition. > [@minouch](#): > > I would like if possible to only receive one email for a specific message per day Since you get one alert per day now, as stated from above you should be good. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [April 11, 2023, 10:03pm UTC](https://community.graylog.org/t/reduce-email-notification-if-same-similar-message/28018/12 "2023-04-11T22:03:40Z")
Closed on April 11, 2023, 10:03pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.