# Email alert after threshold crossed logstash? **URL:** \ **Category:** Elasticsearch\ **Created:** [June 13, 2014, 11:52am UTC](https://discuss.elastic.co/t/email-alert-after-threshold-crossed-logstash/18094 "2014-06-13T11:52:13Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Siddharth\_Trikha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/siddharth_trikha/32/133867_2.png) [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Post date:** [June 13, 2014, 11:52am UTC](https://discuss.elastic.co/t/email-alert-after-threshold-crossed-logstash/18094/1 "2014-06-13T11:52:13Z")
I am using logstash, elasticsearch and kibana to analyse my logs. I am alerting via email when a particular string comes into the log via email output in logstash: email { match =\> ["Session Detected", "logline,_Session closed_"] ........................... } This works fine. Now, I want to alert on the count of a field (when a threshold is crossed): Eg If user is field, I want to alert when number of unique users go more than 5. Can this be done via email output in logstash?? Please help. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/cc8f4f96-6593-424d-9599-759092b5c409%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/cc8f4f96-6593-424d-9599-759092b5c409%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![marcmga](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Post date:** [November 25, 2015, 3:30pm UTC](https://discuss.elastic.co/t/email-alert-after-threshold-crossed-logstash/18094/2 "2015-11-25T15:30:19Z")
I'm interested on that question. I'm facing it too. Is there a way to send an email after crossing a threshold? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:35pm UTC](https://discuss.elastic.co/t/email-alert-after-threshold-crossed-logstash/18094/3 "2017-07-05T23:35:51Z")