Receive different alerts for different hosts

[asikarwar]

I agree this is very very very important and i have posted a similar topic though it was more focused on the message format but at the end one should know the hosts in critical state.

Please see the topic i posted and add your comment to get more traction:

Mustache template aggregate, group by

I went through the following topic: I also need to aggregate the result. I can create the message output using the following: triggered Alert for Host: {{_source.host.name}} with Severity: {{ctx.trigger.severity}} for log level *{{_source.log.level}} event_id: {{_source.winlog.event_id}} But how can i aggregate the alert message output by host and the number/total count of event_id using the query response? Desired Output: Trigger: Test Trigger if Event_id count >= 1 Severity: 1 Period…