# Logstash events count and get alert
**URL:** https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850
**Category:** Logstash
**Created:** [February 19, 2021, 12:14pm UTC](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850 "2021-02-19T12:14:36Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@bdn](https://discuss.elastic.co/u/bdn)
#### Post date: [February 19, 2021, 12:14pm UTC](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850/1 "2021-02-19T12:14:36Z")
I want to count events in Logstash and get me alert if events hit more than 10 times within 2mins.
E.g. I have a log like below.
```auto
Feb 19 15:22:01 DEVICE-01 Device is online.
Feb 19 15:22:01 DEVICE-02 Device is online.
Feb 19 15:22:01 DEVICE-03 Device is online.
Feb 19 15:22:01 DEVICE-03 Device is offline.
Feb 19 15:22:02 DEVICE-01 Device is offline.
Feb 19 15:22:02 DEVICE-01 Device is online.
```
I have multiple devices sending events to the Logstash server and I want to get alerts through email if it hits the defined count value.
Like, If "Device-01" comes online more than 10 times within 2min then it should notify me through email mentioning the Device name in the email body. I managed to get an alert if only 1 device is available but couldn't succeed in multiple devices log.
I am using metrics filter here.
```auto
filter {
if "online" in [device_msg] {
metrics {
meter => ["events"]
flush_interval => 120
clear_interval => 120
add_tag => "events"
}
}
}
```
```auto
output {
if "events" in [tags] {
if [events][count] > 10 {
email {
to => 'me@domain.com'
from => 'monitor@domain.com'
subject => 'Device - ALert'
body => "[%{log_timestamp}]\nDeviceName: %{logsource} (%{host})\nMessage: %{device_msg}"
domain => 'smtp.domain.com'
port => 25
}
}
}
```
Email I received.
```auto
[%{log_timestamp}]
DeviceName: %{logsource} (%{host})
Message: %{device_msg}
```
---
### Author:  [@gneves](https://discuss.elastic.co/u/gneves)
#### Post date: [February 19, 2021, 2:28pm UTC](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850/2 "2021-02-19T14:28:03Z")
Hello. I dont have the biggest knowledge about this.
But i've already seen something about the 'throttle filter plugin'.
Maybe you should take a look:
[Throttle filter plugin | Logstash Reference [7.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-filters-throttle.html)
Maybe there is a better or easier way to do it. Hope it helps
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 19, 2021, 6:16pm UTC](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850/3 "2021-02-19T18:16:51Z")
If the sprintf references were not substituted that suggests the field did not exist. How are you parsing out log\_timestamp, logsource etc.?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 19, 2021, 6:17pm UTC](https://discuss.elastic.co/t/logstash-events-count-and-get-alert/264850/4 "2021-03-19T18:17:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.