# Receive different alerts for different hosts

**URL:** <https://forum.opensearch.org/t/receive-different-alerts-for-different-hosts/1448>\
**Category:** Alerting\
**Created:** [September 3, 2019, 6:38pm UTC](https://forum.opensearch.org/t/receive-different-alerts-for-different-hosts/1448 "2019-09-03T18:38:26Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![asikarwar](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/asikarwar/32/286_2.png) [@asikarwar](https://forum.opensearch.org/u/asikarwar)\
**Post date:** [September 4, 2019, 2:07pm UTC](https://forum.opensearch.org/t/receive-different-alerts-for-different-hosts/1448/2 "2019-09-04T14:07:25Z")

</div>

I agree this is very very very important and i have posted a similar topic though it was more focused on the message format but at the end one should know the hosts in critical state.

Please see the topic i posted and add your comment to get more traction:

> [@Mustache template aggregate, group by](https://forum.opensearch.org/t/mustache-template-aggregate-group-by/1446):
>
> I went through the following topic: I also need to aggregate the result. I can create the message output using the following: triggered Alert for Host: {{\_source.host.name}} with Severity: {{ctx.trigger.severity}} for log level \*{{\_source.log.level}} event\_id: {{\_source.winlog.event\_id}} But how can i aggregate the alert message output by host and the number/total count of event\_id using the query response? Desired Output: Trigger: Test Trigger if Event\_id count \>= 1 Severity: 1 Period…

---

_[View the full topic](https://forum.opensearch.org/t/receive-different-alerts-for-different-hosts/1448)._