# Sending Email for each hit of Alert

**URL:** <https://discuss.elastic.co/t/sending-email-for-each-hit-of-alert/360868>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [June 5, 2024, 2:32pm UTC](https://discuss.elastic.co/t/sending-email-for-each-hit-of-alert/360868 "2024-06-05T14:32:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MaximH](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@MaximH](https://discuss.elastic.co/u/MaximH)\
**Post date:** [June 5, 2024, 2:32pm UTC](https://discuss.elastic.co/t/sending-email-for-each-hit-of-alert/360868/1 "2024-06-05T14:32:30Z")

</div>

Hello there!  
I have the use case that we store k8s logs in Elasticsearch, and now want to send alerts containing the logmessage from said logs with kibana alerts.  
I have now created an alert firing once a loglevel equaling ERROR is detected:

```auto
{
  "_source": ["loglevel", "logmessage","servicename","kubernetes.namespace"],
  "query": {
    "match": {
      "loglevel": "ERROR"
    }
  }
}

```

I managed to send emails containing each logmessage for all found documents in the current run/action of the alert.  
However we would rather have one email per document where the loglevel equals "ERROR" per Alert fire.  
Is this possible to achieve while retaining the ability to send the logmessage along the email?

Best regards,  
Maxim H

---

<div class="post-metadata">

**Author:** ![MaximH](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@MaximH](https://discuss.elastic.co/u/MaximH)\
**Post date:** [July 2, 2024, 10:40am UTC](https://discuss.elastic.co/t/sending-email-for-each-hit-of-alert/360868/2 "2024-07-02T10:40:16Z")

</div>

I solved the issue: In a script block I create an array with all hits, and in the actions iterate over the array for each hit.

---

<div class="post-metadata">

**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\
**Post date:** [July 2, 2024, 2:40pm UTC](https://discuss.elastic.co/t/sending-email-for-each-hit-of-alert/360868/3 "2024-07-02T14:40:13Z")

</div>

Thanks for sharing your solution, @MaximH.