# Trigger Email alert based on custom field

**URL:** <https://community.graylog.org/t/trigger-email-alert-based-on-custom-field/7614>\
**Category:** Graylog Central (peer support)\
**Created:** [November 12, 2018, 10:11pm UTC](https://community.graylog.org/t/trigger-email-alert-based-on-custom-field/7614 "2018-11-12T22:11:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![wangbo223](https://avatars.discourse-cdn.com/v4/letter/w/5f9b8f/32.png) [@wangbo223](https://community.graylog.org/u/wangbo223)\
**Post date:** [November 12, 2018, 10:11pm UTC](https://community.graylog.org/t/trigger-email-alert-based-on-custom-field/7614/1 "2018-11-12T22:11:18Z")

</div>

Hi, I am having a hard time triggering email by Graylog, please help.  
My log file periodically generates something like “statistics: message age: 60”  
And I want to be alerted when the message age is higher than a threshold number.

Here’s my setup,

System Inputs: FileBeat log Input with regular expression extractor defined to extract the “age” field such like “age: 100” as a numeric field.

Input Stream: An RegEx stream when "age: " keyword shows up in the input  
I can verify that I do see the “age” field get populated with the correct value ( from the message stream dashboard )

Alert Condition: A Field Aggregate Alert Condition described as “Alert is triggered when the field age has a higher max value than 5 in the last minute. Grace period: 1 minute. Including last 5 messages in alert notification. Configured to **not** repeat notification”  
Condition Detail: Age Condition  
Field: age  
Time Range: 1  
Threshold Type: higher  
Threshold: 5  
Aggregation Type: max value  
Grace Period: 1  
Message Backlog: 5  
Repeat notifications: false

Alert Notification: An email setup that verified to work ( by other alert conditions ).

It looks like my Alert Condition is never met and never triggered, do I have to do anything special if it’s a custom field?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [November 26, 2018, 10:11pm UTC](https://community.graylog.org/t/trigger-email-alert-based-on-custom-field/7614/2 "2018-11-26T22:11:23Z")

</div>

Closed on November 26, 2018, 10:11pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.