# Group by - Bucket Aggregation in Trigger Condition

**URL:** <https://forum.opensearch.org/t/group-by-bucket-aggregation-in-trigger-condition/5263>\
**Category:** Alerting\
**Created:** [March 8, 2021, 12:02pm UTC](https://forum.opensearch.org/t/group-by-bucket-aggregation-in-trigger-condition/5263 "2021-03-08T12:02:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![GaneshKannan](https://avatars.discourse-cdn.com/v4/letter/g/898d66/32.png) [@GaneshKannan](https://forum.opensearch.org/u/GaneshKannan)\
**Post date:** [March 8, 2021, 12:02pm UTC](https://forum.opensearch.org/t/group-by-bucket-aggregation-in-trigger-condition/5263/1 "2021-03-08T12:02:53Z")

</div>

I’m want to trigger action when from a single ‘host’ a specific log crosses a threshold of 100 / hour.  
What I have now is getting the total count and triggering the alarm, but I want to group by bucket.  
Field name is - ‘host’.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/02d8269b28863091930ddcb8c723e6c1a988f22a.png)

Also, in the condition I need to have the time range; ie. 100 / hour. Thanks in advance. I am new to scripting.

---

<div class="post-metadata">

**Author:** ![kris](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kris/32/2208_2.png) [@kris](https://forum.opensearch.org/u/kris)\
**Post date:** [February 7, 2023, 5:17pm UTC](https://forum.opensearch.org/t/group-by-bucket-aggregation-in-trigger-condition/5263/2 "2023-02-07T17:17:49Z")

</div>

Closed on February 7, 2023, 5:17pm UTC