aggregation with first instant alert and custom output

[paul-mesnilgrente]

Hi, I'd like to create an alert which can group many matched documents.

I first thought that I could create loops with the alert_text_type: alert_text_jinja but the type: frequency contains only 1 matched document. Am I right?

Then I thought that aggregation was the solution but I'd like to get the alert to trigger as soon as something happens and then alert every x minutes with realert. Also, I don't think the output is customizable, or is it? I just saw the summary_table_fields, but it's still a table which I'd like to avoid.

[paul-mesnilgrente]

Maybe my question isn't clear enough. Do you have any questions?

[paul-mesnilgrente]

Could I have an answer on

the type: frequency contains only 1 matched document to display. Am I right?

? I'm still bugged by this

[jertel]

I haven't used frequency much so I can't tell you a yes or no answer. The frequency documentation, specifically the last parameter attach_related suggests that you may be right, as it seems to provide an optional means to include the other events with the alert.

[paul-mesnilgrente]

Ah! I didn't find this option. I'll try to investigate.