# Email notification of mentioned field's data appears x times

**URL:** https://discuss.elastic.co/t/email-notification-of-mentioned-fields-data-appears-x-times/151356
**Category:** Kibana
**Created:** [October 7, 2018, 1:37pm UTC](https://discuss.elastic.co/t/email-notification-of-mentioned-fields-data-appears-x-times/151356 "2018-10-07T13:37:23Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![hammadq](https://avatars.discourse-cdn.com/v4/letter/h/258eb7/32.png) [@hammadq](https://discuss.elastic.co/u/hammadq)
#### Post date: [October 7, 2018, 1:37pm UTC](https://discuss.elastic.co/t/email-notification-of-mentioned-fields-data-appears-x-times/151356/1 "2018-10-07T13:37:24Z")

</div>

Hi,

First i am newbie in kibana and elastic search as well, so basically i am using trial version to test if it meets my requirement or not.

I am trying to trigger an email, Current example, i created an index called nocopasa. in that i have field called source and computer name. What i need is if source appears more than 10 times in every 5 mins then send me the computer name of that records through email. I really don't have any idea how can i achieve this.

Let me know if i am not clear to you.

Thanks

---

<div class="post-metadata">

### Author: ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)
#### Post date: [October 9, 2018, 7:42am UTC](https://discuss.elastic.co/t/email-notification-of-mentioned-fields-data-appears-x-times/151356/2 "2018-10-09T07:42:48Z")

</div>

Hi Hammad, the tool you'll want to use is [Watcher](https://www.elastic.co/guide/en/x-pack/current/xpack-alerting.html#_how_watches_work). You can define an [input](https://www.elastic.co/guide/en/x-pack/current/input.html) to retrieve data from Elasticsearch. In your case, you'll want to use a [date range query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates) to get the occurrence of source in the past 5 mins.

Then you can define a [condition](https://www.elastic.co/guide/en/x-pack/current/input-search.html), which operates on the results of this query. In your case, you can probably use a [compare condition](https://www.elastic.co/guide/en/x-pack/current/condition-compare.html) to compare the results and return true if it is greater than 10.

Finally, you will want to define an [email action](https://www.elastic.co/guide/en/x-pack/current/actions-email.html) to send yourself an email.

Hope this helps!

CJ

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 6, 2018, 7:48am UTC](https://discuss.elastic.co/t/email-notification-of-mentioned-fields-data-appears-x-times/151356/3 "2018-11-06T07:48:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
