# Throttle the alerts
**URL:** https://discuss.elastic.co/t/throttle-the-alerts/139280
**Category:** Logstash
**Created:** [July 10, 2018, 7:08am UTC](https://discuss.elastic.co/t/throttle-the-alerts/139280 "2018-07-10T07:08:05Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@soumya1](https://discuss.elastic.co/u/soumya1)
#### Post date: [July 10, 2018, 7:08am UTC](https://discuss.elastic.co/t/throttle-the-alerts/139280/1 "2018-07-10T07:08:05Z")
Log :
2018-07-10 06:02:22,989 [myid:1] - ERROR Processing ruok command from /127.0.0.1:33542
When the same error comes with a different timestamp i am unable to throttle the alerts
In the filter i have
```
if [log] =~ "ERROR"
{
throttle {
period => 3600
before_count => -1
after_count => 1
key => "%{log}"
add_tag => "raisealert1"
}
}
```
In output i have
if "raisealert1" in [tags] {
```
email {
to => "alerttestgroup@qolsys.com"
from => "xyz"
address => "smtp.office365.com"
codec => "plain"
via => "smtp"
contenttype => "text/html; charset=UTF-8"
username => "xyz
password => "pwd"
subject => " Alert Report %{source} "
body => " Alert LOG is : %{log} %{message} HARDWARE DETAILS : VM1Local CLuster"
port => 587
use_tls => true
authentication => login
}
```
But the alerts are raised for each second.
how can i control the alerts if the same error occurs within an hr for more than 10 times then i have to alert only once.
mailbox is flooding
help pls
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 11, 2018, 9:45pm UTC](https://discuss.elastic.co/t/throttle-the-alerts/139280/2 "2018-07-11T21:45:23Z")
You really don't want to use Logstash in this way. Use a tool meant for alerting instead. If you're storing events in ES have a look at Watcher and Elastalert.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 8, 2018, 9:45pm UTC](https://discuss.elastic.co/t/throttle-the-alerts/139280/3 "2018-08-08T21:45:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.