# Set threshold or condition when to Email in logstash script
**URL:** https://discuss.elastic.co/t/set-threshold-or-condition-when-to-email-in-logstash-script/246373
**Category:** Logstash
**Created:** [August 26, 2020, 3:04am UTC](https://discuss.elastic.co/t/set-threshold-or-condition-when-to-email-in-logstash-script/246373 "2020-08-26T03:04:15Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@David03](https://discuss.elastic.co/u/David03)
#### Post date: [August 26, 2020, 3:04am UTC](https://discuss.elastic.co/t/set-threshold-or-condition-when-to-email-in-logstash-script/246373/1 "2020-08-26T03:04:15Z")
Is it possible to set a threshold or condition when to email to avoid a continuous firing of email?
This is my current script.
if [message] =~ "Caused by:" {
grok{
match =\>["message", "Caused by:"]
add\_tag =\>["shouldmail"]
}
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
}
stdout {
codec =\> rubydebug
}
if "shouldmail" in [tags] {
email {
debug =\> true
to =\> 'dixxx@xxxx.ph,'
username =\> 'davixxxxxxx@gmail.com'
subject =\> 'Alert'
authentication =\> 'plain'
body =\> "try logstash email"
domain =\> '[smtp.gmail.com](http://smtp.gmail.com)'
address =\> '[smtp.gmail.com](http://smtp.gmail.com)'
port =\> 587
password =\> 'trqfvxhndiansafasfvbir'
use\_tls =\> "true"
via =\> 'smtp'
}
}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 26, 2020, 4:33pm UTC](https://discuss.elastic.co/t/set-threshold-or-condition-when-to-email-in-logstash-script/246373/2 "2020-08-26T16:33:38Z")
You may be looking for the [throttle](https://www.elastic.co/guide/en/logstash/current/plugins-filters-throttle.html) filter.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 23, 2020, 4:33pm UTC](https://discuss.elastic.co/t/set-threshold-or-condition-when-to-email-in-logstash-script/246373/3 "2020-09-23T16:33:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.