# (Watcher) send emails separately via a single alert

**URL:** <https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 13, 2021, 6:17pm UTC](https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113 "2021-09-13T18:17:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dovan](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Dovan](https://discuss.elastic.co/u/Dovan)\
**Post date:** [September 13, 2021, 6:17pm UTC](https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113/1 "2021-09-13T18:17:04Z")

</div>

is there any way the emails are sent separately for each alert notification in the watcher?  
as we received several alerts on our team, we preferred that they come separately.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 14, 2021, 7:32am UTC](https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113/2 "2021-09-14T07:32:16Z")

</div>

See [Running an action for each element in an array | Elasticsearch Guide [7.14] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.14/action-foreach.html)

---

<div class="post-metadata">

**Author:** ![Dovan](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Dovan](https://discuss.elastic.co/u/Dovan)\
**Post date:** [September 14, 2021, 8:51pm UTC](https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113/3 "2021-09-14T20:51:00Z")

</div>

hello @spinscale , thanks so much for the help! I tried using foreach but the alerts are still coming in the same email and not in separate emails.  
here is the structure of my watcher:

```auto
  "trigger": {
    "schedule": {
      "interval": "3m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "log"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "action": "Prevent"
                  }
                },
                {
                  "match": {
                    "severity": "Critical"
                  }
                },
                {
                  "exists": {
                    "field": "attack"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-2m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 0
      }
    }
  },
  "actions": {
    "send_email": {
      "foreach": "ctx.payload.hits.hits",
      "max_iterations": 500,
      "email": {
        "profile": "standard",
        "to": [
          "mail@mail.com"
        ],
        "subject": "ELK TEST WATCHER",
        "body": {
          "html": """<table style=" width: 100%; text-align: center;"> <tr >   
        THIS IS A TEST"""
        }
      }
    }
  }
}

```

can you tell me if there's something wrong?

---

<div class="post-metadata">

**Author:** ![RaonyO](https://avatars.discourse-cdn.com/v4/letter/r/5fc32e/32.png) [@RaonyO](https://discuss.elastic.co/u/RaonyO)\
**Post date:** [September 24, 2021, 8:44pm UTC](https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113/4 "2021-09-24T20:44:32Z")

</div>

I'm having the same problem as Dovan.  
can you help? @spinscale

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2021, 8:45pm UTC](https://discuss.elastic.co/t/watcher-send-emails-separately-via-a-single-alert/284113/5 "2021-10-22T20:45:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.