# How to send email alert to groups based on condition success using Kibana Rules

**URL:** <https://discuss.elastic.co/t/how-to-send-email-alert-to-groups-based-on-condition-success-using-kibana-rules/312198>\
**Category:** SIEM\
**Created:** [August 16, 2022, 2:53pm UTC](https://discuss.elastic.co/t/how-to-send-email-alert-to-groups-based-on-condition-success-using-kibana-rules/312198 "2022-08-16T14:53:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bhavya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavya/32/45679_2.png) [@bhavya](https://discuss.elastic.co/u/bhavya)\
**Post date:** [August 16, 2022, 2:53pm UTC](https://discuss.elastic.co/t/how-to-send-email-alert-to-groups-based-on-condition-success-using-kibana-rules/312198/1 "2022-08-16T14:53:49Z")

</div>

I have created a rule using Kibana rules, by following the below steps:

1. Created a new rule by selecting "Rule" under the "Security" section
2. Then selected the rule type as "Event Correlation", wherein I added the index pattern and wrote the EQL (which included the `where` condition to include the events)
3. Added the required fields in the Action section, and then saved the rule.

[![enter image description here](https://us1.discourse-cdn.com/elastic/original/3X/2/4/2452e0b200a8b5b0f0123e247f11ae809d9b6677.png)](https://i.stack.imgur.com/laJV7.png)

I am getting the email alerts based on the condition written, but the alerts are such that:

Suppose a single mail contains the below content -

```auto
ClientName: ABC
HostName: ABC

ClientName: ABC
HostName: ABC

ClientName: DEF
HostName: DEF

```

**But I want to group the mail so that each mail should have data related to only 1 `clientName`. As in this case email should have contained data of only those clients whose name is `ABC`**

**Whereas the data of `clientName` DEF, should be sent in a different mail.**

Is there a way to achieve this type of grouping based on the `clientName`? This similar situation can be done using watcher as given in this [answer](https://stackoverflow.com/questions/72578313/how-to-send-email-alert-to-groups-based-on-condition-success-in-kibana-watcher-a), but can anyone please let me know what the ideal way to do that in my case ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2022, 4:47pm UTC](https://discuss.elastic.co/t/how-to-send-email-alert-to-groups-based-on-condition-success-using-kibana-rules/312198/3 "2022-09-13T16:47:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.